How Hackers Guess Passwords

Three methods account for the vast majority of successful password attacks: credential stuffing, dictionary attacks with rules, and brute force. All three exploit the same underlying weakness — predictability. A password that looks complex can be highly predictable if it follows a pattern an attacker knows to try.

Credential stuffing: the most common attack

Credential stuffing does not involve guessing at all. Attackers take username-and-password pairs from previous data breaches — published or sold online — and test them against other services. If you used the same password on a site that was breached three years ago as you use today on your email provider, an attacker running a stuffing campaign will find it.

This attack is automated and operates at scale. A moderately capable attacker can test thousands of credential pairs per minute against a target site. Large services see millions of stuffing attempts daily. Rate limiting and CAPTCHA slow it down but do not eliminate it.

The defence is complete: use a unique password on every service. A unique password cannot be stuffed, by definition. Credential stuffing is entirely a problem of password reuse.

Dictionary attacks with rules

When an attacker obtains a database of hashed passwords — from a site breach — they do not guess in the dark. They use wordlists: collections of millions of common passwords, words, names, phrases, and previously cracked passwords from other breaches. These wordlists are extended with transformation rules.

Rules are systematic mutations applied to each word: capitalise the first letter, append a digit, replace 'e' with '3', add a symbol at the end. A rule set might apply hundreds of transformations to each word in a list of 10 million entries. This generates hundreds of millions of candidates — and it works because human password creation is predictable. If you capitalised a word, added a number, and put a symbol at the end, the attacker's rule set will find it.

Against a weak hashing algorithm, a consumer graphics card can test billions of candidates per second. Even "complex" passwords that follow predictable patterns will be recovered quickly at that rate. Against a properly configured modern hashing function (bcrypt, scrypt, or Argon2 with appropriate cost factors), the rate drops dramatically — to thousands per second — which is why the hashing algorithm used by a site matters enormously.

Brute force

Brute force is testing every possible combination of characters up to a certain length. It is the least efficient method but the most thorough: given infinite time and hardware, it will eventually find any password. In practice, it is bounded by time and cost.

The relevant question is: at what length and complexity does brute force become impractical? Against a short password (eight characters, all lowercase), brute force is fast even against strong hashing. Against a 16-character password drawn from all four character classes, the search space — roughly 96^16 combinations — is large enough that cracking it within any foreseeable time horizon is not feasible with current hardware, even at high speeds against weak hashing.

Length is the primary defence against brute force. Each additional character multiplies the search space by the size of the character set. Adding characters is more effective than adding character classes.

Rainbow tables

Rainbow tables are precomputed tables of hash values. Rather than hashing a guess and comparing, an attacker looks up a hash directly in the table. This reduces cracking to a fast lookup operation. Rainbow tables were a significant threat when sites stored unsalted hashes — but a cryptographic "salt" (a unique random value added to each password before hashing) renders rainbow tables useless, because every password produces a unique hash even if two users have the same password. Any modern, properly configured password storage system uses salting. If a site is storing passwords without salts in the current era, that is a fundamental implementation failure.

Online guessing and account lockouts

The attacks above are offline: the attacker has a copy of the hash database and is cracking it on their own hardware with no rate limit. Online guessing — trying passwords directly against a live login form — is different. Sites can and do limit login attempts, lock accounts, require CAPTCHAs, and detect unusual login patterns. Online guessing is therefore limited to highly targeted attacks on specific accounts (a known email, specific guesses about the password) and to sites with poor rate-limiting.

This distinction matters: the defences against offline cracking (long, random, unique passwords; good hashing at the site) are different from the defences against online guessing (2FA, account monitoring). A comprehensive defence uses both.

What all of these have in common

Credential stuffing exploits reuse. Dictionary attacks exploit predictability. Brute force exploits shortness. The counter to all three is the same: a long, random, unique password for every account, stored in a manager. Random means unpredictable; long means resistant to brute force; unique means unstuffable.

The additional control that addresses online attacks and account compromise even after a password is leaked is two-factor authentication. A hardware key or an authenticator app means a stolen password alone is insufficient to access an account.