Last updated: August 2026. Written by Josh Hutcheson, OnlineCourseing editor. See our review methodology.
THE SHORT VERSION
Most passwords are not cracked. They are stolen. Guessing attacks still exist and still work against weak systems, but the techniques doing the most damage now take the password — or the session it created — without breaking anything at all.
- The 15 techniques below are grouped by mechanism — online guessing, offline hash cracking, and attacks that skip the password entirely. Each group has a completely different defense, and only one of them cares how clever your password is.
- The defense section follows the current federal standard, NIST SP 800-63B-4, finalized in July 2025 — including the requirement most people have not caught up with.
- We sell no password product, so nothing here routes you to a subscription.
Password attacks are the most misunderstood category in security, because the word “cracking” implies a computer grinding through combinations until it wins. That does happen. It is also, increasingly, the least likely way an attacker ends up holding your credentials.
This guide is written for people learning defensive security: developers building authentication, administrators hardening it, and students working toward a security role. Each technique is described at the level a defender needs to recognize it and shut it down — not as instructions for attacking an account you do not own. The authorization section near the end is not decoration; read it before you practice any of this.
The distinction that decides your defense: cracking vs stealing
Before you spend money on the wrong online course, read this.
Get the free 2026 Platform Comparison Guide — 12 platforms compared on price, certificates, and refund policies. Instant PDF, plus my honest Tuesday picks.
No spam. Unsubscribe anytime.
Nearly every article on this subject presents one flat list of ten or so techniques. That hides the only thing you actually need to know, which is where each attack happens — because that determines what stops it.
| Group | Where it happens | What actually stops it |
|---|---|---|
| Online guessing (1–4) | Against your live login page | Rate limiting and MFA. Password length barely matters here |
| Offline cracking (5–8) | On the attacker’s own hardware, after a breach | Length, and a slow hash. You cannot rate-limit their GPU |
| Bypass (9–15) | Nothing is cracked — the password is handed over or lifted | Phishing-resistant MFA and endpoint hygiene |
The practical consequence is worth stating plainly: a longer password is an excellent defense against group two, a marginal one against group one, and no defense whatsoever against group three. Any advice that answers every password question with “use a stronger password” is answering roughly a third of the problem.
Part 1: Online guessing attacks (1–4)
These all run against a live authentication endpoint, which means you control the conditions. Every one of them is defeated by the same two controls, and neither of them is password complexity.
1. Brute force
Trying every possible combination against one account until something works. It is the technique everyone pictures, and against any competently configured login it is also the least effective, because the server simply stops answering. Its real home is offline work against stolen hashes, which is group two.
What stops it: rate limiting, progressive delays, and account lockout thresholds. MFA makes a success useless even if the guess lands.
2. Dictionary attack
Rather than every combination, a curated list: leaked passwords, common words, sports teams, keyboard patterns. It works because human password choice is heavily clustered — a list of a few million candidates covers a large share of real passwords.
What stops it: screening new passwords against a known-breached list at the moment they are set. This is the single highest-value password control most sites still do not implement.
3. Password spraying
The inversion of brute force, and the reason lockout policies alone are not enough. Instead of many passwords against one account, the attacker tries one common password against many accounts, staying under the per-account threshold that would trigger a lockout. It is quiet, it is patient, and it routinely succeeds in large organizations where somebody is always using the season and the year.
What stops it: rate limiting measured across accounts and source addresses rather than per account, plus breached-password screening and MFA.
4. Credential stuffing
No guessing at all. The attacker replays username and password pairs already exposed in some other service’s breach, betting on reuse. Because the credentials are real, these attempts look like ordinary failed logins until one succeeds, and the success rate only needs to be a fraction of a percent to be worth automating.
What stops it: MFA, breached-credential screening, and monitoring for the distinctive pattern of many accounts each seeing a single failed attempt from rotating addresses.
Part 2: Offline cracking attacks (5–8)
Everything changes once the attacker has your password database. There is no rate limit on their own hardware, no lockout, and no alerting. At that point the only two things standing between a stolen hash and a usable password are how long the password is and how slow your hashing algorithm is.
5. Hash cracking with GPUs
Modern cracking rigs compute enormous numbers of hash guesses per second, which is why the choice of hashing algorithm matters more than almost any other implementation decision. A fast general-purpose hash such as MD5 or SHA-1 was never designed to resist this; a deliberately slow, memory-hard password hash is.
What stops it: a purpose-built password hash — Argon2, scrypt, or bcrypt — with a unique per-password salt, plus genuine password length. Never a bare general-purpose hash.
6. Rainbow tables
A precomputed lookup that trades storage for time, letting an attacker reverse hashes without recomputing them. Rainbow tables are largely a solved problem, and it is worth knowing why: a unique random salt on every password makes precomputation useless, because the attacker would need a separate table per user.
What stops it: per-password salting, which every modern password hashing library does for you by default.
7. Rule-based and mask attacks
The technique that actually breaks “complex” passwords. Cracking software applies transformation rules to dictionary words in exactly the patterns humans use — capitalize the first letter, append a year, swap a for @, add an exclamation mark. A mask attack goes further and exploits known structure, such as “eight characters, first capital, last two digits.”
What stops it: length rather than decoration. Composition tricks produce the very patterns these rules are written to try; a longer passphrase does not.
8. Spidering
Building a targeted wordlist from the victim’s own public footprint — a company’s site, its marketing copy, product names, executives, local sports teams — then feeding that into a dictionary or rule-based attack. It is why organizational passwords are often more guessable than personal ones.
What stops it: the same defenses as group one and two, plus not treating internal vocabulary as secret. Screening against breached lists catches the generic half; length handles the rest.
Part 3: Attacks that skip the password entirely (9–15)
This is where most real account compromise now happens, and where password strength contributes nothing. Nothing is cracked. The credential is handed over, captured, or lifted from a machine that already has it.
9. Phishing
A message impersonating something trusted, collecting the credential directly. It remains effective because it targets judgement rather than software, and because a convincing login page is trivial to clone.
What stops it: phishing-resistant MFA. The distinction matters: a hardware security key or passkey is cryptographically bound to the real site’s domain and will not authenticate to a lookalike, whereas a one-time code can simply be typed into the fake page by the victim.
10. Adversary-in-the-middle and session-token theft
The reason “we enabled MFA” is not the end of the story. A proxy sits between the victim and the genuine site, relaying the login in real time — so the victim passes the MFA challenge legitimately, and the attacker captures the resulting session token. With the session in hand, the attacker never needs the password or the second factor again.
What stops it: phishing-resistant, origin-bound authenticators (passkeys and security keys), which will not complete on the proxy’s domain; plus short session lifetimes, token binding where available, and a way to revoke active sessions.
11. Infostealer malware
Commodity malware that runs on a victim’s machine and exfiltrates everything credential-shaped in one pass: browser-saved passwords, cookies, session tokens, autofill data. The output is sold in bulk, which is where a great deal of the material behind credential stuffing and account takeover originates.
What stops it: endpoint controls rather than password policy. Nothing you do to a password protects it from a machine that is already compromised — which is also the strongest argument against storing passwords in a browser profile on a shared or unmanaged device.
12. Keylogging
Capturing keystrokes at the point of entry, whether by software on a compromised machine or a hardware device inline with the keyboard. Older than infostealers and narrower in scope, but the principle is identical: the password is recorded as it is typed, so its strength is irrelevant.
What stops it: endpoint security and physical control of the machine. Authenticators that do not involve typing a reusable secret — passkeys, security keys — remove the thing a keylogger is trying to capture.
13. Traffic interception
Reading credentials off the wire on a network the attacker controls or has positioned on. This was once a routine risk on open Wi-Fi; universal HTTPS has substantially closed it for web logins, though legacy protocols and internal services that still speak plaintext remain exposed.
What stops it: TLS everywhere with HSTS, and auditing internal services for anything still authenticating in the clear.
14. Social engineering and help-desk pretexting
Not tricking the user — tricking the people who can reset the user’s credentials. An attacker with enough plausible context calls support and asks for a password reset or an MFA re-enrollment. Several of the most significant intrusions of recent years began exactly here, because the account recovery path is frequently weaker than the login it protects.
What stops it: treating identity verification at the help desk as an authentication decision with a defined standard, and requiring out-of-band confirmation for MFA resets. Your account recovery flow is your real authentication mechanism, because it is the one an attacker will choose.
15. Shoulder surfing
Observing entry directly — over a shoulder, on camera, or from a screen visible in a shared space. Low-technology and easy to dismiss, but it is a live risk in open offices, on public transport, and anywhere a screen faces a room.
What stops it: awareness, privacy filters, and not typing credentials on camera. MFA limits the value of a single observed password.
See the cyber security courses we rate →
What the current standard actually requires
Most password advice online is inherited rather than checked. The authoritative reference for the United States is NIST Special Publication 800-63B, and its current revision — SP 800-63B-4, finalized in July 2025 — is more prescriptive than most write-ups on this topic acknowledge. Three of its requirements are worth quoting, because they are stated as SHALL, not as suggestions.
- Length. Verifiers “SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.” If your mental benchmark is still eight, it is out of date by a wide margin.
- No composition rules. Verifiers “SHALL NOT impose other composition rules” — no mandatory mixed case, digits or symbols. Those rules push users toward exactly the predictable patterns that rule-based cracking (technique 7) is built to exploit.
- No forced rotation. Verifiers “SHALL NOT require subscribers to change passwords periodically.” Scheduled expiry produces incremental variants rather than genuinely new secrets. Change a password when there is evidence it is compromised.
The standard also expects new passwords to be screened against lists of known-compromised values — the direct answer to techniques 2, 3 and 4. Individuals can check their own exposure at Have I Been Pwned.
The honest ranking of defenses
Most guides on this topic are published by companies selling a password manager, an identity product or an authentication platform, and they tend to conclude that you should buy one. We sell nothing in this category, so here is the ordering on merit.
- Deploy phishing-resistant MFA — passkeys or hardware security keys. This is the only control on the list that addresses all three groups at once, and it is the only thing that meaningfully answers techniques 9, 10 and 12.
- Screen passwords against breached lists at the moment they are set. One control, three attacks.
- Fix your hashing — Argon2, scrypt or bcrypt with per-password salts. This is what decides how bad a future breach is.
- Rate limit across accounts, not just per account, or spraying walks straight past you.
- Harden the account recovery path to the same standard as the login. Attackers pick the weaker door.
- Then password length — 15 characters or a passphrase — and a password manager to make that practical. Genuinely useful, and still further down this list than most articles put it.
Before you practice any of this: authorization is the whole ballgame
Reading this is defensive knowledge and carries no risk. Running any of it against an account or system you do not own does. The line is not the technique, it is whether you had permission, and that line is drawn in law rather than in etiquette.
In the United States, unauthorized access to a computer is governed by the Computer Fraud and Abuse Act; in the United Kingdom, by the Computer Misuse Act 1990. Both turn on authorization rather than on intent or on how much harm resulted, so “I was only curious” and “I was testing a friend’s security” are not defenses. Recovering a password on an account belonging to a partner, a family member or a colleague is unauthorized access, however the request is framed.
Legitimate password auditing happens inside a written scope that names the systems, the window, and the party with standing to authorize it. To practice the techniques themselves, use environments built for it: cracking exercises against hashes you generated yourself, or hosted labs such as PortSwigger’s Web Security Academy, TryHackMe and Hack The Box. We cover the boundary in full in is ethical hacking legal.
Where to learn this properly
Recognizing these attacks is one thing; being able to test authentication systems for them, or design one that resists them, is another. Both of our starting points are chosen on merit rather than on what pays us: the best cyber security courses for the defensive path, and the best ethical hacking courses if you want the offensive testing side. For the web layer specifically, PortSwigger’s Web Security Academy is free and has an excellent authentication-vulnerabilities track — we earn nothing from recommending it.
Compare ethical hacking courses →
Frequently asked questions
What is the most common password attack?
By volume of successful account takeovers, credential stuffing and phishing dominate — both of which use a real password rather than cracking one. Pure brute force against a live login is largely ineffective against any system with rate limiting. The distinction matters because the defenses are different: stuffing is answered by breached-password screening and MFA, not by password complexity.
How long should a password be?
NIST SP 800-63B-4, finalized in July 2025, states that verifiers “SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length.” The same standard says verifiers “SHALL NOT impose other composition rules,” so length and uniqueness matter far more than mandatory symbols or mixed case.
Does multi-factor authentication stop all password attacks?
No, and the exception is important. Adversary-in-the-middle phishing relays a login in real time and captures the resulting session token, so the victim passes the MFA challenge and the attacker inherits the session anyway. Codes sent by SMS or generated by an app are vulnerable to this. Phishing-resistant, origin-bound authenticators — passkeys and hardware security keys — are not, because they will not authenticate to a lookalike domain.
Should I change my passwords regularly?
Not on a schedule. NIST SP 800-63B-4 states that verifiers “SHALL NOT require subscribers to change passwords periodically,” because forced expiry produces small predictable variations rather than genuinely new secrets. Change a password when there is evidence it has been exposed.
How do social media accounts actually get taken over?
Almost never by cracking the password. In practice it is phishing, a password reused from a service that was breached, an infostealer that captured a saved browser session, or a compromised recovery email or phone number. That is why enabling multi-factor authentication and securing the recovery address protects a social account far more than lengthening its password does.
Is it legal to test password attacks?
Only against systems you own or have written permission to test. Unauthorized access is a criminal offense under the Computer Fraud and Abuse Act in the United States and the Computer Misuse Act 1990 in the United Kingdom, and both turn on authorization rather than intent. Attempting to recover another person’s password without their authorization is an offense regardless of your relationship to them.
Related guides
- Website hacking techniques — the application-layer companion to this page
- Best cyber security courses — the defensive learning path
- Best ethical hacking courses — the offensive testing path
- Network security threats — where traffic interception sits
- Wi-Fi pentesting tools — the wireless side
- Ethical hacking tools — the professional toolkit
- Is ethical hacking legal? — the authorization question in full
- Hacking terms — the 78-term glossary, grouped by attack stage