We tested three different kinds of passwords with an open-source password cracking tool to find out which approach really keeps a password safe.
What Is Password Cracking?
When you create an account on an online service, your login credentials are usually encrypted and stored on a server. The process relies on a special algorithm called a hashing algorithm, which converts your password into a complex string of characters known as a hash.
What is a hash?
A hash is not a random string. It is the output of a specific mathematical formula. The hash can only be produced from the password you typed, and to a layperson it looks like meaningless gibberish. What makes it special is that generating a hash is very fast, while reversing the hash to recover the original password is extremely difficult, nearly impossible.
Why do hashes matter?
Instead of storing your actual password, online services store only the hash. When you log in, the system runs the password you enter through the hashing algorithm to generate a new hash, then compares it with the hash saved on the server. If the two match, you get access. This approach helps protect your information if the data on the server is compromised.
How hackers crack passwords
If a file containing password hashes leaks, hackers will try to crack the passwords to recover the originals. Because generating a hash is much faster than reversing one, hackers typically build a list of likely passwords (known as a dictionary attack) and run them through the hashing algorithm. They then compare the generated hashes against the leaked database. When a hash matches, the hacker can identify the corresponding original password.
How can you protect your password?
Understanding how hashes work helps you appreciate why protecting your personal information matters. Use a complex password that combines uppercase letters, lowercase letters, numbers, and special characters. In addition, turning on two-factor authentication (2FA) and changing your passwords regularly will reduce the risk of a breach.
A Guide to Testing Your Passwords With HashCat
To illustrate, we will use Hashcat, a free, open-source password cracking tool that anyone can get. It will help you see how hackers can crack passwords and why creating a strong one is so important.
In this test, we will try to crack three common passwords:
- 123456: This is one of the most common and least secure passwords in the world. According to NordPass statistics, more than 3 million accounts have used it, including 1.2 million at the corporate level.
- Susan48!: This password was built the way most users think is safe: a mix of letters, numbers, and symbols. Although it meets basic security standards, it still has weaknesses that are easy to exploit.
- t9^kJ$2q9a: A password randomly generated with Bitwarden's tool. At 10 characters, with uppercase letters, lowercase letters, numbers, and symbols, it represents a high standard for protecting your information.
First, we will hash these passwords with the MD5 algorithm. This is how they would look if stored in a password file:
- 123456: e10adc3949ba59abbe56e057f20f883e
- Susan48!: df1ce7227606805745ee6cbc644ecbe4
- t9^kJ$2q9a: 450e4e0ad3ed8766cb2ba83081c0a625
Next, we will use Hashcat to try to crack these passwords and see how the difficulty of cracking depends on password complexity.
A Simple Cracking Attempt With a Dictionary Attack
The dictionary attack is one of the most common ways to attack passwords. The hacker takes a list of likely passwords and has a tool like Hashcat convert them into hashes (MD5) to compare against the stored ones. In this example, we will use the file “rockyou.txt” - one of the largest leaked password databases in history - as the dictionary list.
To begin, open Terminal in the folder that contains Hashcat. Once Terminal is open and pointed at that folder, you can run Hashcat with the following command:
.hashcat -m 0 -a 0 passwordfile.txt rockyou.txt -o results.txt
What the command means:
- .hashcat: Launches the Hashcat application.
- -m 0: Specifies the hash type. Here it is MD5, which is listed as number 0 in the Hashcat documentation.
- -a 0: Specifies the attack mode. The dictionary attack is labeled number 0.
- passwordfile.txt rockyou.txt: The first file holds the password hashes to crack, and the second is the password dictionary list.
- -o results.txt: Specifies the file where the results will be saved, in this case “results.txt”.
Even though “rockyou.txt” is a very large file, Hashcat took just 6 seconds to process all of it. The results in “results.txt” show that the password 123456 was cracked successfully. The other passwords, Susan48! and t9^kJ$2q9a, were not cracked because they are not in the “rockyou.txt” dictionary.
This shows that widely used passwords like 123456 are easy to compromise, while more complex passwords like Susan48!, or randomly generated ones like t9^kJ$2q9a, can hold up against ordinary dictionary attacks.
A Tougher Test With Brute Force: Attacking Passwords With Masks
A dictionary attack works well when the target password appears in a list of common passwords, such as a large leaked database. It is fast and easy to run, but it cannot crack passwords that are not in the dictionary list. So if you want to test the real strength of a password, Brute Force is worth considering.
Unlike a dictionary attack, which only tries preset passwords, Brute Force checks every possible combination of characters. It is harder to run and takes longer, but it can eventually crack any password. The time required can sometimes stretch very long, though, depending on the password's complexity and length.
To run a basic Brute Force attack, use the following Hashcat command:
.hashcat -m 0 -a 3 target.txt --increment ?a?a?a?a?a?a?a?a?a?a -o output.txt
What the command means:
- -a 3: Selects the Brute Force method.
- target.txt: The file containing the password hashes to crack.
- --increment: Tells Hashcat to start with passwords 1 character long, then work upward in length.
- ?a?a?a?a?a?a?a?a?a?a: This mask tells Hashcat to try every character (uppercase, lowercase, numbers, symbols) at each position.
- -o output.txt: Saves the results to the file “output.txt”.
With this mask, Hashcat cracked the password “123456” within 15 seconds, since it is one of the most common and weakest passwords. The password “Susan48!” is more complex, with an estimated cracking time of about 4 days using unoptimized Brute Force.
Optimizing Brute Force With a Specific Mask
People who create passwords tend to arrange characters in predictable patterns. For example, “Susan48!” capitalizes the first letter and adds a number and a symbol at the end. To take advantage of this, we can use a specific mask:
.hashcat -m 0 -a 3 -1 ?a target.txt ?u?l?l?l?l?a?a?a -o output.txt
What the mask means:
- ?u: Specifies an uppercase character in the first position.
- ?l: Specifies a lowercase character in the following positions.
- ?a: Tries any character (letter, number, symbol) in the final positions.
With this mask, Hashcat cracked “Susan48!” in 3 minutes 10 seconds, significantly faster than 4 days.
For More Complex Passwords
A password like “t9^kJ$2q9a”, which is randomly generated and follows no pattern, requires Brute Force without a specific mask. However, at 10 characters with the full character set, Hashcat runs into a limit on the number of combinations. Security experts say that cracking this password would take 3 years, which shows how effective a complex, random password is.
In short, Brute Force is a powerful way to test password strength, but optimizing it with a specific mask can cut the required time dramatically, especially for passwords that follow common patterns.
What Protects the Bitwarden Password, and Tips for Better Security
What makes the Bitwarden password so hard to crack is its 10-character length and its randomness and unpredictability. These are the key factors that blunt cracking attacks, especially because hackers cannot use a mask to guess where each component, such as a letter, number, or symbol, sits.
To protect your password, make it as long as possible and include a random mix of symbols, numbers, uppercase letters, and lowercase letters. This random distribution makes it hard for cracking tools to predict and test combinations, which greatly increases the time and effort needed to break the password.
Familiar advice like “use a range of characters” and “make your password as long as possible” really is what makes a password safer. Once you understand the reasoning behind these rules, it becomes easy to tell a weak, vulnerable password from a strong one that is hard to breach.
