Password Cracking: Techniques and Defenses

Password cracking is the process of recovering plaintext passwords from their stored, protected form — usually cryptographic hashes — or from other protected data. In authorized security testing it measures how resistant an organization's credentials are to a determined attacker, revealing weak passwords and poor storage practices before real adversaries exploit them. Understanding password cracking, and the defenses that thwart it, is fundamental to both offensive security and building systems that protect user accounts.

What Is Password Cracking?

Well-designed systems never store passwords in plaintext. Instead they store a hash, the output of a one-way function that is easy to compute forward but infeasible to reverse. When a user logs in, the system hashes the entered password and compares it to the stored value. Because the hash cannot be directly reversed, an attacker who steals a database of hashes must instead guess candidate passwords, hash each guess, and check for a match.

That guessing process is password cracking. Its feasibility depends on three things: the strength of the password, the cost of the hashing algorithm, and whether the defender used protections like salting. Cracking is a core activity in penetration testing, where recovered credentials often unlock further access.

Why Hashing and Salting Matter

Not all hashing is equal. Fast, general-purpose hash functions were designed for speed, which is exactly wrong for passwords — an attacker can compute billions of guesses per second on commodity hardware. Purpose-built password hashing functions are deliberately slow and resource-intensive to make each guess expensive.

A salt is a unique random value combined with each password before hashing. Salting ensures that two users with the same password produce different hashes, which defeats precomputed lookup tables and forces attackers to crack each hash individually. A missing or reused salt is a serious weakness a tester will flag immediately.

Password Cracking Techniques

Attackers and testers draw on several strategies, often in combination:

• Dictionary attacks try passwords from curated wordlists of common and previously breached passwords. Because people reuse predictable choices, this is remarkably effective and fast.
• Brute-force attacks systematically try every possible combination within a character set and length. Guaranteed to succeed eventually, but the cost explodes with password length, making long passwords impractical to brute force.
• Rule-based attacks apply transformations to dictionary words — capitalizing letters, appending numbers, or substituting symbols — mimicking how humans modify passwords to meet complexity rules.
• Mask attacks target a known or suspected password pattern, dramatically shrinking the search space when the structure is predictable.
• Rainbow tables are precomputed tables that trade storage for speed when cracking unsalted hashes. Proper salting renders them useless.
• Credential stuffing reuses username and password pairs leaked from one breach against other services, exploiting password reuse rather than cracking a hash at all.

Offline vs Online Cracking

Offline cracking happens after an attacker has obtained the hashes, letting them guess as fast as their hardware allows with no interaction with the target. Online cracking guesses against a live login interface and is far slower and noisier, easily blunted by rate limiting and lockouts. Offline attacks are the greater threat, which is why how passwords are stored matters so much.

Tools of the Trade

Two tools dominate legitimate password auditing:

• Hashcat is a fast, GPU-accelerated cracker supporting a huge range of hash types and attack modes.
• John the Ripper is a flexible, long-standing cracker popular for its automatic mode and broad format support.

In an authorized engagement, a tester might audit hashes they lawfully obtained against a well-known wordlist:

# Audit captured lab hashes against a wordlist (authorized use only)
hashcat -m 0 hashes.txt wordlist.txt

The mode and options are chosen to match the specific hash algorithm in use. These same tools help defenders proactively find weak passwords in their own systems.

Defenses Against Password Cracking

Because cracking targets stored credentials, robust defenses focus on storage and authentication design:

1. Use a strong password hashing function built for the purpose, such as bcrypt, scrypt, or Argon2, which are deliberately slow and memory-hard.
2. Always salt every password with a unique random value to defeat precomputation.
3. Encourage long passphrases. Length beats complexity; a long, unique passphrase resists brute force far better than a short, gnarly one.
4. Enforce multi-factor authentication (MFA), so a cracked password alone does not grant access.
5. Rate-limit and lock out repeated failed logins to neutralize online attacks.
6. Screen against breached-password lists so users cannot choose credentials already known to attackers.

Together these measures can make cracking economically infeasible even if a hash database is stolen.

Legal and Ethical Use

Password cracking is legal only against systems and data you own or are explicitly authorized to test. Cracking credentials you have no permission to touch, or reusing leaked credentials against live accounts, is a crime regardless of intent. Ethical practitioners crack only hashes obtained within an engagement's defined scope, protect any recovered credentials as sensitive data, and report weaknesses through responsible disclosure.

To build cracking skills safely, use your own test systems, deliberately vulnerable labs, and CTF challenges. Recovered credentials frequently become the pivot point for privilege escalation, so understanding both topics together strengthens any tester's toolkit.

Key Takeaways

• Password cracking guesses candidate passwords against stolen hashes or protected data to measure credential strength.
• Salting defeats precomputed tables, and slow, purpose-built hashing like bcrypt, scrypt, or Argon2 makes each guess expensive.
• Core techniques include dictionary, brute-force, rule-based, mask, and rainbow-table attacks, plus credential stuffing that exploits password reuse.
• Offline cracking is the major threat because it runs at full hardware speed without touching the target.
• Defend with strong salted hashing, long passphrases, MFA, and rate limiting, and crack only what you are authorized to test.