This article tested three different types of passwords using an open-source password cracking tool to determine which method is truly effective in ensuring password security.
What is Password Cracking?
When you create an account on online services, your login information is usually encrypted and stored on a server. This process uses a special algorithm called a hashing algorithm to convert your password into a complex string of characters known as a hash.
What is a Hash?
A hash is not a random string but the result of a specific mathematical formula. This hash string can only be generated from the password you enter, and to a non-expert, it looks like an incomprehensible mess. The special thing is that creating a hash is very fast, but reverse-decoding a hash to recover the original password is extremely difficult, almost impossible to perform.
Why is hashing important?
Instead of storing original passwords, online services only store the hash string. When you log in, the system runs the password you enter through the hashing algorithm to create a new hash string, then compares it with the hash string stored on the server. If they match, you are granted access. This method helps protect your information in case the server data is compromised.
How hackers crack passwords
If a file containing password hashes is leaked, hackers will attempt to crack the passwords to find the original content. Since creating a hash is much faster than reverse-decoding, hackers often create lists of potential passwords (known as a dictionary attack) and run them through the hashing algorithm. Then, they compare the generated hashes with the leaked database. If a hash matches, the hacker can identify the corresponding original password.
How to protect your password?
Understanding how hashing works helps you realize the importance of personal information security. Use complex passwords that combine uppercase letters, lowercase letters, numbers, and special characters. Additionally, enabling two-factor authentication (2FA) and changing passwords periodically will help minimize the risk of compromise.
Guide to self-checking passwords with HashCat
To illustrate, we will use Hashcat, a free and open-source password cracking tool accessible to anyone. This tool will help you better understand how hackers can crack passwords and why creating strong passwords is important.
In this test, we will attempt to crack three common passwords:
- 123456: This is one of the most common and least secure passwords in the world. According to statistics from NordPass, over 3 million accounts have used this password, including 1.2 million corporate accounts.
- Susan48!: This password is created in a way that most users think is secure: combining letters, numbers, and symbols. Although it meets basic security standards, it still possesses vulnerabilities that are easy to exploit.
- t9^kJ$2q9a: A password generated randomly using Bitwarden’s tool. With 10 characters including uppercase, lowercase, numbers, and symbols, this password represents a high standard for information protection.
First, we will encode these passwords using the MD5 algorithm. This is how they would appear if stored in a password file:
- 123456: e10adc3949ba59abbe56e057f20f883e
- Susan48!: df1ce7227606805745ee6cbc644ecbe4
- t9^kJ$2q9a: 450e4e0ad3ed8766cb2ba83081c0a625
Now, we will use Hashcat to attempt to crack these passwords and discover how the ease of cracking depends on password complexity.
Simple cracking attempt with the Dictionary Attack method
A Dictionary Attack is one of the most common password attack methods, where hackers use a list of potential passwords and request a tool like Hashcat to convert them into hashes (MD5) to compare with the stored hashes. In this example, we will use the “rockyou.txt” file—one of the largest leaked password databases in history—as our dictionary list.
To start, open Terminal in the directory containing Hashcat. Once the Terminal is open and you have navigated to this directory, you can run Hashcat with the following command:
.hashcat -m 0 -a 0 passwordfile.txt rockyou.txt -o results.txt
Command breakdown:
- .hashcat: Activates the Hashcat application.
- -m 0: Specifies the type of encoding used. In this case, it is MD5, identified as number 0 in the Hashcat documentation.
- -a 0: Specifies the attack mode. Dictionary Attack is labeled as number 0.
- passwordfile.txt rockyou.txt: The first file contains the password hashes to be cracked; the second file is the password dictionary list.
- -o results.txt: Specifies the file where the results will be saved, which is “results.txt” here.
Even though the “rockyou.txt” file is very large, Hashcat only takes 6 seconds to process all the data. The results shown in the “results.txt” file indicate that the password 123456 was successfully cracked. However, other passwords like Susan48! and t9^kJ$2q9a were not cracked because they were not in the “rockyou.txt” dictionary list.
This proves that passwords like 123456, which are commonly used, are easily compromised, while more complex passwords like Susan48! or randomly generated ones like t9^kJ$2q9a are capable of resisting common dictionary attacks.
Trying a more complex Brute Force: Password attack with masking techniques
A Dictionary Attack is an effective cracking method when the password to be cracked is within a list of common passwords, such as a large leaked database. This method is fast and easy to perform but cannot crack passwords that do not appear in the dictionary list. Therefore, if you want to test the true strength of a password, Brute Force is a worthwhile option.
Unlike a Dictionary Attack which only tries pre-set passwords, Brute Force checks every possible character combination. Although this method is more difficult and time-consuming, it can eventually crack any password. However, the required time can sometimes be very long, depending on the complexity and length of the password.
To perform a basic Brute Force attack, use the following Hashcat command:
.hashcat -m 0 -a 3 target.txt --increment ?a?a?a?a?a?a?a?a?a?a -o output.txt
Command breakdown:
- -a 3: Defines the Brute Force method.
- target.txt: The file containing the password hashes to be cracked.
- –increment: Instructs Hashcat to try passwords starting from a length of 1 character, then increasing incrementally.
- ?a?a?a?a?a?a?a?a?a?a: This mask requires Hashcat to try every character (uppercase, lowercase, numbers, symbols) at each position.
- -o output.txt: Saves the results to the “output.txt” file.
With this mask, Hashcat cracks the password “123456” in 15 seconds, as it is one of the most common and weakest passwords. The password “Susan48!” is more complex, with an estimated cracking time of about 4 days if using a non-optimized Brute Force method.
Optimizing Brute Force with specific Masks
Password creators often tend to place characters in predictable patterns. For example, “Susan48!” is created by capitalizing the first letter and adding numbers and symbols at the end. To take advantage of this, we can use a specific mask:
.hashcat -m 0 -a 3 -1 ?a target.txt ?u?l?l?l?l?a?a?a -o output.txt
Mask breakdown:
- ?u: Specifies an uppercase character at the first position.
- ?l: Specifies lowercase characters at the subsequent positions.
- ?a: Tries any character (letter, number, symbol) at the final positions.
With this mask, Hashcat cracks “Susan48!” in 3 minutes 10 seconds, significantly faster than 4 days.
For even more complex passwords
Passwords like “t9^kJ$2q9a”, which are randomly generated and do not follow any pattern, require Brute Force without a specific mask. However, with a length of 10 characters and a full character set, Hashcat will face a limit on the number of combinations. Security experts state that cracking this password could take up to 3 years—demonstrating the effectiveness of using complex, random passwords.
In conclusion, Brute Force is a powerful method to test password strength, but optimization through specific masks can significantly shorten the required time, especially for passwords following common patterns.
Bitwarden password protection factors and tips to enhance security
The reason Bitwarden passwords are difficult to crack is their 10-character length and randomness, making them unpredictable. These are crucial factors that reduce the effectiveness of cracking attacks, especially when hackers cannot use masks to predict the position of each component like letters, numbers, or symbols.
To protect your password, ensure it is as long as possible and includes a random mix of symbols, numbers, uppercase, and lowercase letters. This random distribution makes it difficult for cracking tools to predict and test combinations, significantly increasing the time and effort required to break the password.
Common advice such as “use a character array” and “create the longest password possible” are truly key factors in making passwords more secure. Understanding the reasoning behind these principles will help you easily recognize the difference between a weak, easily attackable password and a strong, impenetrable one.
