Understanding Password Hacking: Methods and Prevention
Explore how passwords are compromised, including methods such as brute force and what defenses to implement.
What is this page about?
An explainer of how passwords actually get hacked, arguing most compromises come from weak, reused, and poorly stored passwords rather than brilliant exploits, with NordPass 2024 data showing "123456" and "password" still near the top. It compares cracking methods (breach databases, brute force, dictionary attacks, credential stuffing, rainbow tables), explains how password storage should work with hashing, why length beats complexity, the case for password managers and how they secure data, comparisons including open-source Bitwarden, and passkeys as the path beyond passwords.
What has been corrected on this page?
Every accepted correction to this page is recorded with the exact change, so readers can see how the page improved over time.
-
2 corrections applied: 26^20 is ~2x10^28; ratio to 95^8 is ~3 trillion, not 3 billion | The 2007 study reported ~6.5 passwords per user, not 6.5 minutes/day of friction
Beforeproduces about 19 trillion trillion combinations, roughly 3 billion times larger...; documented that web users spent an average of 6.5 minutes per day
Afterproduces about 20 thousand trillion trillion combinations, roughly 3 trillion times larger...; documented that the average web user had roughly 6.5 distinct passwords
Why: Body content already correctly fixed (20 thousand trillion trillion / 3 trillion times; 6.5 distinct passwords). But the FAQ (decoded via 4-step op-sequence) still had a stale leftover: 'roughly 3 billion times more combinations' in the length-vs-complexity answer. Fixed to '3 trillion times', re-encoded via the same op-sequence in reverse, PUT, and verified clean on re-fetch.
View the full record →
Who checked this page?
1 contributor has checked "Understanding Password Hacking: Methods and Prevention" on When Notes Fly. Each name below links to that person's public CitePep profile, where every contribution they have made is listed with the exact change they proposed.