Hollywood shows password cracking as someone guessing your dog's name at a login screen. Real cracking almost never looks like that. Websites throttle or lock accounts after a handful of failed attempts, so attackers rarely bother hammering the front door. Instead, they steal the database out the back - A file of password hashes - And attack it offline on their own hardware, at millions or billions of guesses per second, with no rate limits and no alarms.
Understanding that one shift - Online guessing versus offline cracking - Explains almost everything about why some passwords survive for centuries and others fall before you finish reading this sentence.
First, what attackers actually steal: hashes
Reputable services never store your password as plain text. They store a hash: the output of a one-way function that turns correct horse battery staple into a fixed-length string of gibberish. When you log in, the site hashes what you typed and compares the result. The function can't be run backwards, so an attacker who steals the database can't simply read your password out of it.
What they can do is guess. Cracking is just automated guessing at absurd speed: pick a candidate password, hash it, compare it to the stolen hash. Match? Cracked. No match? Next candidate. The entire cat-and-mouse game comes down to two numbers: how many candidates the attacker must try, and how fast each try runs.
Speed depends heavily on which hash the site used. Fast hashes like MD5 - You can compute some yourself with an MD5 hash generator to see how instant it is - Were designed for speed, which is exactly wrong for passwords. A single modern consumer GPU can test tens of billions of MD5 candidates per second. Deliberately slow algorithms like bcrypt, scrypt and Argon2 cut that to thousands per second. The difference between those two worlds is the difference between "cracked over lunch" and "cracked after the sun burns out," and it's covered in depth in our guide to MD5 vs SHA-256 vs bcrypt.
Brute force: trying everything
Pure brute force enumerates every possible combination: a, b, c … aa, ab, and so on. It is guaranteed to work eventually - The question is whether "eventually" arrives before the heat death of the universe.
The math is unforgiving in both directions. Each character you add multiplies the search space by the size of the character set. An 8-character lowercase password has about 209 billion possibilities - A few seconds of GPU time against a fast hash. Go to 16 random characters drawn from the full keyboard and you're at roughly 4 × 10³¹ possibilities, which no fleet of GPUs on Earth will finish. The units involved are explained properly in password entropy explained, but the headline is simple: length compounds, complexity merely adds.
Hive Systems publishes a widely cited annual table of GPU crack times, and the pattern holds every year: short passwords of any composition are effectively free to crack, while long random ones are effectively immortal.
| Password type (fast hash, modern GPU rig) | Approximate time to crack |
|---|---|
| 8 characters, lowercase only | Seconds to minutes |
| 8 characters, mixed case + digits + symbols | Hours to days |
| 12 characters, mixed case + digits + symbols | Centuries |
| 16 characters, fully random, full character set | Billions of years |
| 20 characters, any human-memorable phrase in wordlists | Potentially minutes - Composition beats length here |
That last row is the trap. Brute-force math only applies to random passwords. Human-chosen passwords live in a much smaller, well-mapped space - Which brings us to the attack that does most of the real damage.
Dictionary attacks: guessing like a human
Nobody picks passwords uniformly at random. We pick words, names, dates, keyboard walks and pop-culture references. Attackers know this because they have the receipts: billions of real passwords from past breaches, led by the RockYou leak of 2009 and its enormous descendants, all packaged into wordlists that ship with free tools like Hashcat and John the Ripper.
A dictionary attack tries those real-world candidates first. Instead of searching 10³¹ possibilities, it searches a few billion likely ones - And against a typical user database, that harvests a shocking share of accounts in the first minutes. The same top entries appear year after year; see the most common passwords for how fast the greatest hits fall.
Rules and hybrids: why "P@ssw0rd2026!" doesn't help
Modern crackers don't stop at the raw wordlist. They apply mangling rules that mimic exactly what humans do to satisfy complexity requirements: capitalize the first letter, swap a for @ and o for 0, append a year, add an exclamation mark. Every trick you think makes a password clever is a standard rule that costs the attacker almost nothing extra. Summer2026! isn't one candidate in 10¹⁹ - It's a top-tier dictionary word plus three of the most common rules in existence.
Rule of thumb: if there's a story for how you built your password, there's a Hashcat rule that tells the same story faster.
Rainbow tables: precomputed cracking (mostly a solved problem)
Rainbow tables flip the cost of cracking: instead of hashing guesses at attack time, you precompute hashes for huge swaths of the password space once, compress the results cleverly, and then reverse any stolen hash with a quick lookup. In the mid-2000s, freely downloadable tables could break nearly any Windows LM or unsalted MD5 hash in minutes.
The defense turned out to be simple: salting. A salt is a unique random value stored alongside each user's hash and mixed into the computation. Because every user's salt is different, a precomputed table would need to be rebuilt per user - Which destroys the entire economy of precomputation. Any competently built system today salts every hash, which is why rainbow tables are now more history lesson than live threat. They still matter for one reason: plenty of ancient, unsalted databases are still out there getting breached, and those crack in bulk.
Where cracking fits in the bigger attack chain
Cracking is only one route to your password, and often not the cheapest one. Verizon's Data Breach Investigations Report finds year after year that stolen credentials are the single most common way attackers get in - And many of those credentials are never cracked at all. They're phished, grabbed by infostealer malware, or simply replayed from an old breach against your other accounts, an attack called credential stuffing that works precisely because people reuse passwords.
That's worth internalizing: a 40-character masterpiece protects you from cracking, but not from typing it into a fake login page. Cracking resistance and phishing resistance are separate problems with separate fixes.
What actually protects you
The good news is that beating every technique in this article requires no cleverness - Cleverness is the thing that fails. It requires randomness, which machines are better at than you are.
- Make passwords long and machine-random. A password generator produces 16–20 fully random characters that no dictionary, rule set or rainbow table has any purchase on. For anything you must type from memory, a five-word Diceware-style passphrase gets you comparable strength.
- Never reuse. Unique passwords ensure that when one site's database falls, the blast radius stays at one site.
- Check your weak spots. A password strength checker that estimates entropy and flags dictionary patterns will tell you honestly whether a password lives in the crackable zone - Ours runs entirely offline in your browser.
- Turn on two-factor authentication. Even a cracked password is a dud if the attacker can't produce your second factor.
FAQ
How fast can a hacker crack an 8-character password?
Against a fast hash like MD5 or NTLM, an 8-character password of any composition falls to a modern GPU rig within hours at worst, and often within seconds if it contains a word or pattern. Against a slow hash like bcrypt it takes far longer, but you shouldn't count on a site's hashing being done right. Treat 8 characters as broken and use 12–16 minimum.
Are rainbow tables still a real threat?
Rarely. Salting - Standard practice for well over a decade - Makes precomputed tables useless because each user's hash would need its own table. They remain relevant only against legacy systems that store unsalted hashes, which unfortunately still surface in breaches of older services.
Do symbols and numbers make my password uncrackable?
No. Substitutions like @ for a and a trailing 1! are the first mangling rules every cracking tool applies, so they add almost nothing against a dictionary attack. Length and true randomness dominate: a random 16-character password beats a "clever" 10-character one by many orders of magnitude.
Can hackers crack passwords directly on the website's login page?
Online guessing exists but is slow and noisy - Sites rate-limit, lock accounts and flag the traffic. Serious cracking happens offline against stolen hash databases, where the attacker's only limit is hardware. The related online attack that does scale is credential stuffing, which replays already-known passwords rather than guessing new ones.
Is a passphrase really as strong as a random password?
A passphrase of five or more words chosen randomly from a large wordlist (true Diceware, not a lyric you like) has comparable entropy to a strong random password and is far easier to type and remember. The critical word is randomly - A famous quote or song line is in every serious wordlist and cracks quickly.