Compromised credentials remain one of the most common ways intrusions begin, year after year, across every published breach report. Understanding how passwords are attacked is what makes the defensive advice make sense.
It also cures people of some very persistent bad habits.
Hashing, and Why It Matters
Systems should not store your password. They store a hash: a one way transformation that is easy to compute forwards and impractical to reverse.
When you log in, the system hashes what you typed and compares. That way a stolen database does not immediately hand over passwords.
The catch is that hashing does not stop guessing. An attacker with the hashes can guess offline, as fast as their hardware allows, with no lockout and nobody watching.
Why the Algorithm Choice Decides Everything
Fast hash algorithms such as MD5, SHA-1, and SHA-256 were designed for speed. That is exactly wrong for passwords, because speed helps the attacker far more than the defender.
Modern graphics hardware computes enormous numbers of fast hashes per second. Against a fast algorithm, short and common passwords fall almost instantly.
Purpose built password hashing algorithms such as bcrypt, scrypt, and Argon2 are deliberately slow and memory hungry. The same guessing attack becomes orders of magnitude more expensive.
Salting, meaning a unique random value per password, is what stops one cracked hash from revealing every user who chose the same password, and it is what killed precomputed rainbow tables as a practical technique.
The Attack Types
Brute force tries every combination. It is only practical against short passwords, and it is the reason length matters.
Dictionary attacks try known words and previously leaked passwords, which is far more effective because humans pick predictable things.
Rule based attacks apply transformations to a dictionary: capitalize the first letter, append a year, replace a with an at sign. This is why P@ssw0rd2025 is not clever. It is one of the first things tried.
Password spraying reverses the usual approach. Instead of many passwords against one account, which triggers lockout, it tries one likely password against every account in the organization. It defeats lockout policies and it works depressingly often.
Credential stuffing reuses username and password pairs from other breaches, betting that people reuse them. They do.
The tools you will meet are Hashcat and John the Ripper for offline cracking, both included in Kali Linux.
Why Length Beats Complexity
Each additional character multiplies the search space. Each additional character class only increases the base.
That is why a long passphrase of ordinary words beats a short string of symbols, and why the modern guidance from NIST in Special Publication 800-63 moved away from mandatory complexity rules and periodic forced rotation.
Those old rules produced predictable behavior. Forced complexity gave you Password1!, and forced rotation gave you Password2!, written on a sticky note. NIST now recommends checking passwords against known breached lists and requiring a change only when there is evidence of compromise.
What Actually Stops These Attacks
Phishing resistant multi factor authentication. It is the single highest value control, because it means a stolen password on its own is not enough. Hardware keys and passkeys built on FIDO2 resist relay attacks that authenticator app codes do not. See identity and MFA.
Checking new passwords against breached password lists at the moment they are set, which stops credential stuffing at the source.
A password manager, so every account has a different long random password and reuse stops being possible. This is the highest impact thing an individual can do.
Detection on the authentication side: alerting on spraying patterns, which look like a small number of failures across a very large number of accounts, and on successful logins from unusual locations or impossible travel.
And proper protection of the hashes themselves, since most of this only matters once an attacker has them.
Where Passwords Are Going
Passkeys replace the shared secret with a key pair. The private key stays on your device, the service holds only the public key, and there is nothing phishable to steal. Adoption across major platforms and services has been steady, and the specifications come from the FIDO Alliance and W3C.
Passwords will not disappear soon, because legacy systems outlive everything. Both models will coexist for years, which means both sets of defenses stay relevant.
Learn This at HackRange
Module 6 of the CEH course cracks real password hashes in a lab, which is the fastest way to understand why the policy advice is what it is.