In Hollywood movies, password cracking is portrayed as a blinking cursor trying random words against a live login screen until green text flashes "ACCESS GRANTED".
In real-world cybersecurity, live online guessing is obsolete. Understanding how password cracking actually functions reveals why character length and Shannon entropy are your only true defenses.
Step 1: The Database Breach & Hash Extraction
Websites should never store your actual password in cleartext. Instead, when you create a password, the server passes it through a one-way cryptographic hash function:
Password ("CorrectHorse") → SHA-256 → c775e7b757ede630cd0aa1113bd10266...A hash function is one-way: it is mathematically impossible to reverse the hash back into the password.
However, when an attacker breaches a company's database, they steal the list of user hashes. The attacker can then take the stolen hashes onto their own high-powered offline computers and run guesses without ever interacting with the website again.
Step 2: The Attack Strategies
1. Dictionary Attacks & Wordlists
Cracking suites like Hashcat start with massive wordlists compiled from billions of previous data breaches (such as the famous rockyou.txt list). The program hashes each word and checks if it matches the stolen hash. If you used a known password, it is cracked in milliseconds.
2. Rule-Based Mutation Attacks
Next, cracking software applies mutation rules to every word in the dictionary:
- Capitalizing the first letter or alternating case.
- Leetspeak substitutions: replacing 'e' with '3', 'a' with '@', 'o' with '0'.
- Appending years (1900–2030) and common symbols (!, $, #).
A modern GPU tests tens of millions of mutation combinations per second against every single dictionary word. To counter this, OWASP Password Storage Cheat Sheet mandates adaptive slow-hashing schemes such as Argon2id, PBKDF2, or bcrypt.
3. Exhaustive Mask & Brute-Force Attacks
If dictionary and rule attacks fail, the attacker switches to brute force. They specify a character mask (for example: 8 characters of mixed letters and numbers) and systematically test every possible permutation from aaaaaa00 to ZZZZZZ99.
Why Offline Cracking Ignores Rate Limits
On a live website, you cannot try 10,000 passwords because the server will lock the account or show a CAPTCHA after 5 failed attempts.
In an offline attack, the attacker owns the hardware. A single Nvidia RTX 4090 GPU can calculate over 10 billion fast hashes per second with zero network lag and zero account lockouts.
The Ultimate Defense: High-Entropy Passwords
The only thing that stops an offline GPU cluster is mathematics. When your password exceeds 16 random characters or 4 random words:
- It does not exist in any dictionary list.
- No mutation rule can anticipate truly random character selections.
- The total keyspace (9516) requires billions of years to exhaust.