Password cracking isn’t a single technique — it’s a toolkit of increasingly sophisticated methods, each designed to exploit a different weakness in how humans choose passwords. Understanding how these attacks work tells you exactly what defenses are effective and which password habits leave you exposed, because each method has a specific, known countermeasure.

1. Brute Force Attacks

The simplest method: systematically try every possible combination of characters. A brute force attack on a 6-character lowercase password has 26^6 = 308 million combinations — manageable with modern hardware. The same attack on a 12-character random password with full character sets has more combinations than atoms in the observable universe.

Pure brute force is rarely the first approach today because it’s inefficient for longer passwords. But it’s still the fallback when other methods fail, and it’s devastatingly effective against short passwords regardless of their complexity.

Defense: Length. Every additional character multiplies the search space. 16+ characters makes brute force computationally infeasible.

2. Dictionary Attacks

Instead of random combinations, dictionary attacks test words from curated wordlists. These lists contain millions of common passwords, dictionary words in hundreds of languages, names, places, sports teams, and terms from popular culture. The leaked RockYou database alone contains 14 million real-world passwords — that’s the starting point for most dictionary attacks.

Defense: Avoid any real word, name, or phrase that could plausibly appear in a dictionary or wordlist. Randomly generated passwords are immune; human-created passwords are often not.

3. Rule-Based (Mangling) Attacks

Rule-based attacks apply transformation rules to dictionary entries: capitalize the first letter, append numbers, replace letters with symbols. Tools like Hashcat ship with thousands of pre-built rules that model exactly how humans modify passwords: “P@ssword”, “dragon1!”, “CompanyName2026”. If a human thought of the transformation, it’s probably in the ruleset.

Defense: Understand that any predictable modification of a base word — no matter how clever it feels — is likely already in an attacker’s ruleset. Genuinely random passwords sidestep this entirely.

4. Credential Stuffing

Credential stuffing isn’t cracking in the traditional sense — it doesn’t need to crack anything. It takes email/password pairs from one breach and tries them against other services. With billions of breached credentials available, attackers run automated tools that test these combinations against Gmail, banking sites, and e-commerce platforms. Success rates of 0.1–2% sound small but at scale mean millions of successful account takeovers.

Defense: Use a unique password for every site. This is the primary defense because credential stuffing only works when passwords are reused.

5. Rainbow Table Attacks

Password databases store hashes — the output of a one-way function — rather than plaintext passwords. Rainbow tables are pre-computed lookup tables that map hash values back to the original password. If an attacker has the hash “5f4dcc3b5aa765d61d8327deb882cf99” and a rainbow table, they can instantly look up that it corresponds to “password.”

Modern systems use “salting” (adding a random value before hashing) to defeat rainbow tables — each password produces a unique hash even if the passwords are identical. Most current breach data uses salted hashes, making rainbow tables largely obsolete. Older breaches often did not.

Defense: Strong passwords provide a secondary defense even when sites salt hashes correctly. Avoid using any password that appears in known wordlists.

6. Phishing and Social Engineering

The most effective password attacks often don’t involve cracking at all. A well-crafted phishing page that mimics a legitimate login form will capture your password in plaintext — complexity and length are irrelevant. SMS phishing, voice phishing (“vishing”), and fake tech support calls are equally effective against otherwise strong passwords.

Defense: 2FA provides meaningful protection even when your password is phished — the attacker needs both factors. Use authenticator apps rather than SMS codes, which can be SIM-swapped. Verify URLs before entering credentials, and use a password manager that will not autofill on spoofed domains.

7. Keyloggers and Session Hijacking

Malware that logs every keystroke you type, or that steals an active browser session cookie, bypasses password strength entirely — the attacker either sees your password as you type it or doesn’t need it at all because they’ve stolen an already-authenticated session. This is a growing category of attack precisely because password strength has improved industry-wide, pushing attackers toward methods that don’t require breaking the password itself.

Defense: Keep your operating system and browser updated, use reputable antivirus software, avoid downloading software from untrusted sources, and log out of sensitive sessions on shared or public devices rather than leaving them open.

8. Shoulder Surfing and Physical Observation

The least technical attack on this list: someone simply watches you type your password, or finds it written on a sticky note. This remains surprisingly common in shared workspaces, cafes, and households. It’s also the primary reason biometric unlock (fingerprint, face recognition) exists as a daily-use alternative — it can’t be observed and copied the way a typed password can.

Defense: Be aware of your surroundings when entering sensitive passwords in public. Use biometric unlock where available for daily access, reserving the underlying password for account recovery scenarios.

The Actual Tools Behind These Attacks

Two open-source tools dominate real-world password cracking: Hashcat and John the Ripper. Both are legitimate security research tools, widely used by penetration testers and security teams to audit their own systems — and by attackers, since the tools themselves don’t distinguish intent. Hashcat is GPU-accelerated and optimized for raw speed against fast hash algorithms; it ships with pre-built rule files (best64.rule, rockyou-30000.rule) that encode exactly the kind of human password-modification habits described above. John the Ripper is more flexible for CPU-based and custom hash formats, often used against slower algorithms like bcrypt where GPU acceleration matters less.

Both tools are freely downloadable, meaning the barrier to running a serious password-cracking operation against a stolen hash database is not sophistication — it’s simply obtaining the breach data, which is traded openly on criminal marketplaces. This is why “no one would bother targeting my account specifically” is the wrong mental model: attackers aren’t targeting you individually, they’re running these tools against millions of hashes from a single breach and taking whatever falls out.

How Fast Is “Fast”? A Hardware Comparison

The notable point isn’t the top end — it’s how accessible the middle tier is. A single consumer gaming GPU, the kind used for playing video games, is enough to run a meaningful dictionary and rule-based attack against a stolen hash database in a matter of hours. This is not a nation-state-level resource; it’s equipment many households already own.

How These Attacks Combine in Practice

Real-world attacks rarely use just one technique. A typical large-scale attack against a stolen breach database runs in stages: first, known passwords and previously-cracked hashes are checked instantly (a “known password” lookup). Next, dictionary and rule-based attacks recover the 30–60% of passwords that follow common human patterns, usually within the first hour of compute time. Only after those fast, cheap methods are exhausted does an attacker move to slower, more expensive brute-force attempts against the remaining hashes — and even then, they typically prioritize shorter or lower-entropy passwords first, since the return on investment for cracking a genuinely random 16-character password is rarely worth the compute cost.

Which Attack Method Is Most Dangerous to You Personally?

Signs a Password May Have Already Been Cracked or Exposed

You often won’t be notified directly when a password has been recovered from a breach dump — the more common signal is downstream activity on the account itself. Watch for: login notifications from unfamiliar locations or devices, password reset emails you didn’t request, new devices or app connections appearing in your account’s security settings, or contacts receiving spam/phishing messages that appear to come from you. Any of these can indicate that a previously “strong-looking” password has, in fact, already fallen to one of the methods above via a breach on a different service.

Because credential stuffing relies on reused passwords, checking whether your email address appears in known breach data is one of the fastest ways to find out if a password you’re still using elsewhere needs to be retired. Our Email Exposure Report checks your address against breach databases directly, so you’re not relying on guesswork or waiting for suspicious activity to notice.

Evaluating Your Exposure

The Password Strength Test evaluates your password’s resistance to the attack methods above — including dictionary, hybrid, and brute-force scenarios — without asking for your actual password. It assesses your strategy so you can understand where the real risks lie.

Frequently Asked Questions

Q: Which attack method do hackers use most often in practice?

A: Credential stuffing and dictionary/hybrid attacks account for the large majority of successful account takeovers, because they’re cheap, fast, and exploit extremely common human habits (reuse and predictable patterns) rather than requiring expensive computation.

Q: Can a strong password protect me from phishing?

A: No. Phishing captures whatever you type, regardless of its strength. The relevant defenses are 2FA, URL verification, and a password manager that won’t autofill credentials on a spoofed domain.

Q: Are rainbow table attacks still a real threat today?

A: Less than they used to be, since most modern services salt their password hashes, which defeats pre-computed rainbow tables. They remain relevant against older, poorly-secured systems or historical breach data.

Q: How much does 2FA actually help against these attack types?

A: Significantly, across almost every method on this list. Even if a password is cracked, phished, or stuffed successfully, an attacker still needs the second factor, which stops the vast majority of automated attacks in their tracks.

Q: Is there any single defense that covers all of these attack types?

A: No single defense does, which is why a layered approach works best: a password manager with unique random passwords (covers brute force, dictionary, credential stuffing), 2FA (covers phishing and cracked passwords), and basic device hygiene (covers keyloggers and shoulder surfing).

Related Reading

• The Most Common Passwords (And Why They Never Go Away)
• How to Create a Strong Password (Step-by-Step Guide)
• How Long Would It Take to Crack Your Password?
• Password Manager vs. Memorizing Passwords: Which Wins?
• Try our free Password Strength Test →