How Password Cracking Works, and How to Stop It

Penetration testers crack passwords to show how weak ones put a whole network at risk. Developers and administrators need to understand the same process to store passwords safely. This guide explains how it works in plain language.

Why Systems Store Hashes

A well-built system does not store your password. It stores a hash: the output of a one-way function. When you log in, it hashes what you typed and compares. If the database leaks, attackers get hashes, not passwords, and must crack them by guessing.

How Cracking Works

Cracking is guessing at speed: hash a candidate password, compare with the stolen hash, repeat billions of times. Tools such as Hashcat and John the Ripper do this using graphics cards. The common methods:

• Dictionary attacks: try words from lists of real leaked passwords
• Rules: apply common changes to each word: capital first letter, add a year, swap "a" for "@"
• Masks: try patterns such as a word followed by four digits
• Brute force: try every combination, only practical for short passwords

Why Some Hashes Fall Fast

• Fast, general-purpose hashes (old MD5 or SHA-1 schemes, and Windows NTLM hashes) can be tested at enormous speed
• No salt: without a unique random value added to each password, identical passwords have identical hashes and precomputed tables work
• Slow, salted password hashes such as bcrypt, scrypt and Argon2 are designed to make each guess expensive, so cracking is far slower

Where Testers Meet Hashes

In network assessments, hashes appear in captured authentication traffic, in Kerberoasting and AS-REP roasting, and in credential dumps from compromised machines. Cracking a few shows the client which passwords and policies are weak. See Active Directory attacks explained. Any cracked passwords are client data: handle them as the contract requires and never reuse them.

Learning More

Password attacks against network services and Active Directory are part of our network and Active Directory course, and authentication flaws in web apps and APIs are covered in the Application Security course.