Here’s the best way to protect yourself against password cracking:
- 🔐 Use a trusted password manager like 1Password to generate complex passwords which are virtually impossible to crack. 1Password stores all passwords using advanced encryption and auto-saves and auto-fill all of your logins. It also alerts you when your passwords are compromised in a data breach.
Hackers use several password cracking methods to breach online accounts. As online attacks increase, it’s important to know how hackers crack passwords so you can prevent your login credentials and other personal information from being stolen.
This article covers commonly used password cracking techniques, popular cracking tools, what you should do if your password has been cracked, and how to protect your passwords.
Download 1Password (14 days Risk-Free)
3 Quick Steps to Protect Your Passwords From Hackers:
- Create long, complex, unique passwords for each of your accounts. 16-character passwords (or longer) with a variety of characters are difficult to crack.
- Enable two-factor authentication (2FA) for your accounts. 2FA requires you to provide an extra form of verification in combination with your password, usually a one-time code.
- Use a password manager. A password manager like 1Password makes it much easier to securely store and organize hundreds of complex passwords.
We DO NOT encourage or condone password cracking or hacking. This article is solely for educational purposes and is aimed at individuals looking to protect their passwords and better understand cybersecurity risks.
11 Most Common Password Cracking Techniques
While there are many password cracking and hacking methods, here are the most commonly used techniques.
1. Brute-Force Attacks
A brute-force attack involves a hacker randomly generating thousands of potential passwords every minute based on different variables, including a combination of characters, like uppercase and lowercase letters, numbers, and special characters, and then entering them into the password field.
While hackers can manually enter the generated passwords, they can also use a brute-force attack program that essentially bombards the login field with password combinations until it guesses the correct one.
The description above is a classic form of a brute-force attack. However, there are other types of brute-force attacks, including:
- Reverse brute-force attacks — This attack involves a hacker starting with a password linked to a website account and attempting to guess the matching username.
- Credential stuffing attacks — Hackers will use stolen credentials on other websites in hope that the user will have reused the same username and password for multiple sites.
- Hybrid brute-force attacks — Using a combination of brute-force attack techniques and a database of known leaked passwords.
2. Dictionary Search Attacks
A dictionary search attack involves hackers cracking passwords with a “dictionary list” of common words and phrases. This type of password cracking technique is similar to a brute-force attack. Hackers simply use dictionary words or use sophisticated tools to edit each word, such as replacing “O” with “0” or adding punctuation to guess the password combination.
3. Guessing the Password
Yep, if hackers aren’t able to use brute-force programs, they can always resort to guessing a user’s password. Hackers can guess a user’s password by learning more about the user — family name, home address, pet names, date of birth, etc. — and entering password combinations based on the user’s personal information.
4. Phishing
Phishing is a technique where hackers create copycat websites aimed at deceiving users into giving away login credentials or other personal information.
The most common phishing techniques include:
- Email phishing — Sending mass emails that include links to phishing sites to random recipients.
- Spear phishing — Emailing phishing links to specific individuals, commonly company employees.
- Smishing — Sending scam SMS messages with
- Social media phishing — Posting links to malicious sites on social networking sites, especially in comment sections e.g. YouTube comments or Twitter replies.
Phishing is one of the most common cybersecurity threats. However, if you have reputable internet security software installed on your devices, like Norton or Bitdefender, it should prevent you from accessing phishing sites or alert you to suspicious links.
5. Social Engineering
Social engineering is where hackers deceive targets into giving away private information by posing as legitimate actors, such as banking support representatives. Hackers leverage a target’s background information to better manipulate them into unknowingly giving away information.
Examples of social engineering attacks are usually carried out in a variety of ways, including:
- Scam phone calls — Targets are convinced to give away personal information to a scammer posing as a representative of a legitimate company, such as a bank.
- Emails — Scammers will send carefully crafted emails posing as legitimate actors and will either convince targets to give away private information or download malware onto their devices. Scammers will usually engage in a conversation with the target to build trust.
- Social media messages — Hackers may pose as company accounts or even friends to deceive users.
- In person — Scammers may even perform social engineering attacks in person, sometimes dressing in a fake uniform to appear as though they are representing a company and asking a series of questions.
6. Spyware
Spyware is a type of hidden malware that can monitor and record your every move on a computer or smartphone. It can even adjust your device’s settings and control webcams. Essentially, spyware can watch your every move online, view the sites you visit, and record the usernames and passwords you use to access sites. Hackers can then easily access your accounts.
Spyware is usually difficult to detect, but an effective antivirus scanner will be able to detect and remove spyware.
7. Keyloggers
Keyloggers or keylogging malware records your keyboard strokes in an attempt to steal your sensitive information. This kind of malware is classed as a form of spyware. Once a keylogger records your keystrokes, it will transmit the information to hackers who will then determine the accounts associated with your login credentials.
8. Man-in-the-Middle (MITM) Attacks
A Man-in-the-Middle attack involves hackers spying on network activity and intercepting data transferred across a network, including usernames, passwords, payment card details, and more. MITM attacks commonly occur on unsecured networks, such as public Wi-Fi hotspots, which enable bad actors to employ sophisticated hacking techniques (such as IP spoofing) to intercept network data.
9. Spidering
Spidering is a password cracking technique where a hacker collects information regarding a company or individual with the goal of better guessing their login credentials. After researching a victim’s social media, web presence, and other sources, a hacker would then generate password combinations based on the collected information, such as passwords including the victim’s date of birth, company name, etc.
10. Rainbow Table Attacks
A rainbow table is a large, precomputed table of reversed hashes that are used for cracking password hashes. However, hackers first must have access to a list of password hashes before conducting a rainbow table attack, which are usually accessible after a data breach. These attacks can be stopped through a modern technique called “salting.” Salting adds an extra random value to every hashed password in order to generate a different hash value and is included with most password authentication systems.
11. Data Breaches
Data breaches involve hackers accessing a company’s servers where you have an account and stealing a variety of sensitive data, including usernames and passwords. If one or more of your passwords has been compromised in a data breach, you should immediately secure your account and change passwords.
Popular Password Cracking Tools
The most popular password cracking tools include:
- Cain and Abel. Cain and Abel is a popular password cracking tool that’s only available for Windows. It can perform a wide range of functions, including analyzing route protocols and packets, scanning wireless networks for MAC addresses, and conducting brute-force or dictionary attacks.
- Hashcat. Hashcat is a free, open-source password cracking tool for Windows, macOS, and Linux. It’s the fastest password cracker out there and can also perform brute-force and dictionary attacks.
- John the Ripper. John the Ripper is a command-based password cracking application for Linux and macOS. It’s free, open-source, and supports various cipher and hash types, including Unix, macOS, and Windows user passwords, web applications, and database servers.
- Ophcrack. Ophcrack is a free, open-source tool that’s designed to crack password hashes using rainbow table attacks. It’s available for Windows, macOS, and Linux. It comes with a brute-force attack feature and is able to crack most passwords in a matter of minutes.
- RainbowCrack. RainbowCrack is a brute-force password recovery tool that generates rainbow tables in order to crack victims’ passwords.
- CrackStation. CrackStation is a free password cracker that also uses rainbow tables to access password hashes.
- WFuzz. WFuzz is a password cracking tool that’s primarily made for cracking web application passwords with brute-force attacks.
There are also many other password cracking tools out there, and hackers may even use multiple tools at once for faster results, so it’s important to stay vigilant.
How to Find Out If Your Password Has Been Cracked
- Use a breach scanner. A data breach scanner from a top password manager like 1Password will notify you if any of your passwords or other personal data were leaked on the dark web following a data breach.
- Look for suspicious activity. If you notice any unusual actions like unauthorized messages sent from your email address, your password was most likely hacked and you need to secure your account immediately.
- Be aware of login notifications from unfamiliar devices or locations.If you receive an account login notification from an unrecognized device or location, it likely means a hacker has access to your account’s password.
- Check a compromised password database. If you have a password that is commonly used (like password123), it will appear while checking a database of known compromised passwords and should be changed as soon as possible.
- Look for two-factor authentication (2FA) code requests. If you get a two-factor authentication code sent to your device without requesting it, it’s very likely that your password has been hacked and an attacker is trying to access your account.
What Should You Do If Your Passwords Are Compromised?
The very first thing you should do after finding out your passwords are compromised is to change them immediately. This is the best way to minimize any damage that could be done by hackers after having unauthorized access to your account. If you haven’t already, you should also turn on two-factor authentication for the account associated with your compromised password.
Additionally, it’s a good idea to download a top password manager with a data breach scanner to see if any more of your sensitive data has been leaked by hackers. 1Password’s Watchtower feature, for example, notifies you if any of your passwords have been compromised in a data breach.
You should also run a dark web scan to see if any other personal data has been leaked and subscribe to a reputable identity theft provider, which will help you subvert hackers from further exploiting your personal information.
How to Protect Your Password From Being Cracked (or Hacked)
Create Strong Passwords
The best way to protect your password from being cracked is to use long, complex passwords that are difficult to crack — the longer and more complex a password is, the hard it is to crack. A short password such as “cats123” could be cracked within a matter of minutes (if not seconds!), but a password like “CaTs-are_my-Favor1tE_aN1maL!” would take millions of years to crack using the tools available today.
Use a Password Manager
A password manager app like 1Password is a great way to store your login credentials securely — all details are stored using advanced encryption, making it virtually impossible for hackers to access them unless they have the master password.
Password managers can also easily generate long, complex passwords that are hard for hackers to crack. Most top password managers have password generators with high character limits that allow you to use a mix of numbers, letters, and symbols.
Install Antivirus Software
By installing antivirus software, you’re able to keep your device better protected against popular password hacking techniques like phishing and spyware. Most top antivirus programs allow you to enable web protection in order to stop hackers from accessing your passwords through phishing attacks.
Norton stands out as the best antivirus for thwarting password cracking, boasting a 100% malware detection rate and strong defenses against threats like phishing and ransomware.
Be Aware of Online Scams
When online, be vigilant about dodgy websites. Phishing scams can lure you into divulging login details through misleading emails, texts, or social media messages. Safeguard yourself by scrutinizing messages from unknown senders and not downloading sketchy attachments. Also, you should activate your email’s spam filter to help weed out potential risks.
Keep Your Devices Updated
For maximum protection, it’s crucial to upgrade your device’s software and firmware when indicated. Old software and firmware can contain weaknesses that hackers can exploit. Disregarding updates could leave your device susceptible to cyber threats, which could ultimately result in hackers deploying malware to steal your passwords.
Frequently Asked Questions
Is password cracking illegal?
Yes, password cracking is illegal. While it isn’t illegal to use a password cracking technique to access your own password, doing the same to access someone else’s password can lead to criminal charges.
A top password manager like 1Password can help prevent your password from being cracked by generating new, stronger passwords and storing them securely in your password vault.
How do hackers crack passwords?
Some of the most common password cracking techniques include brute-force attacks, phishing, and spyware. A brute-force attack is when a hacker tries to crack a victim’s password by randomly generating thousands of passwords based on a wide range of variables. Phishing is a tactic where hackers create fraudulent websites aimed at tricking users into giving away their personal data, while spyware is a kind of hidden malware that can record your screen on a computer or smartphone, change your device settings, and even control your webcam.
What kinds of passwords are difficult to crack?
Difficult-to-crack passwords are long, with many characters and a good mix of random numbers, letters, and symbols. With this in mind, the best way to quickly and easily create strong passwords is by using a password generator from a top password manager. My personal favorite is 1Password — it has an excellent password generator that allows you to create up to 100-character passwords using random combinations of numbers, letters, and symbols.
How do you protect your passwords from being cracked or stolen?
Some of the best ways to protect your password from being cracked or stolen include:
A top password manager (like 1Password) can generate highly secure passwords for you, while a highly-rated antivirus program (like Norton) can keep your device protected from password cracking techniques like phishing and spyware. Additionally, it’s important to install all updates on your devices in order for their systems to be protected against any new cyber threats.
