← Security

Password Cracking

Verified Sep 7, 2026

TL;DR

Password strength is only half the story. The other half: how the site stored it. Cracking means guessing passwords and checking them against a stolen hash — and how many guesses per second that allows depends almost entirely on the hashing algorithm, not how clever your password felt. A "strong" password hashed badly falls in seconds. A plain phrase hashed well holds for centuries. Two numbers decide everything: how many guesses exist, and how fast each one can be tried.

ELI5

Picture two locks, both needing a numeric code:
  • Lock A lets you spin the dial and try a new code every millisecond, forever — no wait, no cooldown.
  • Lock B forces a full one-second pause between every attempt.
Both locks can have the exact same number of possible codes. Lock A still falls in minutes, because you can try millions of codes a second. Lock B might take years, because you only get one try per second. That's the whole secret behind password cracking — it's not really about how clever your code is, it's about how fast someone'sallowed to guess. A site choosing Lock A or Lock B decides your fate more than your password does.

WHY IT MATTERS

  • A breach doesn't leak your password. It leaks a hash of it.
  • Cracking = guess a password → hash the guess → check for a match.
  • Speed depends almost entirely on which hash function the site used — not on how clever your password felt.

HOW IT WORKS

Two numbers decide crack time:

  1. Entropy — total guesses that exist for your password.
  2. Hash speed — guesses per second an attacker can try.

Hash speed swings by seven orders of magnitudedepending on the algorithm — see the table below. Same leaked database, wildly different outcome.

Try it yourself

Runs entirely in your browser. Nothing you type is sent anywhere, logged, or stored.

Length0
lowercase0
UPPERCASE0
digits0
symbols0
Entropy0 bits

Same seven scenarios, animated at relative speed(logarithmic scale) so all seven fit in view at once — not real time. The slowest bar here still finishes its lap in seconds; the real crack time for that same scenario can be centuries. The table below has the actual numbers.

Attack scenarioGuesses / secEst. crack time
Online, rate-limited login10—
Online, no rate limit1,000—
Offline, Argon2id (recommended)~100—
Offline, bcrypt (cost 12)~2,500—
Offline, bcrypt (cost 10)~10,000—
Offline, unsalted SHA-256 (GPU)~10 billion—
Offline, unsalted MD5 (GPU)~100 billion—

FAILURE MODES

  • "P@ssw0rd1!" isn't strong. Swapping letters for symbols is the first trick cracking dictionaries try.
  • Reused passwords get cracked once, used everywhere. Your bank password doesn't need cracking if it's the same one from a forum breach three years ago.
  • Length beats complexity. Four random words usually beats an 8-character symbol soup — and you can actually remember it.

DEEP DIVE

Even a well-chosen hash function isn't enough on its own. Two more pieces close the remaining gaps:

  • Salting. A random value, unique per password, stored alongside the hash. Without it, an attacker can precompute a rainbow table — every common password hashed once, reused against every account in every breach forever. A salt makes precomputation worthless: the same password hashes differently on every account.
  • Peppering. A second secret value, shared across the whole site but kept outside the database — in a secrets manager, not a column. If the database leaks but the pepper doesn't, the stolen hashes are useless without it.
  • Tunable cost. Argon2id (the current OWASP recommendation) exposes memory, time, and parallelism as explicit dials. Turning them up costs the server milliseconds per real login — and costs an attacker running billions of guesses proportionally more. That asymmetry is the entire point.

WHAT I LEARNED

You can't control how a site hashes your password. You cancontrol two things that matter regardless:
  • a long, unique passphrase per site
  • a password manager to generate and remember the rest
That combination is what actually survives a breach.

Go deeper