How Are Passwords Cracked? Why Length and Uniqueness Matter

12 min read · Updated: October 23, 2026

Passwords get cracked in three main ways. Attackers guess common ones, try leaked ones that people reuse elsewhere, or trick you into typing yours into a fake site. Making a password long and different for each service helps more than adding symbols or changing it often. Multi-factor authentication and passkeys add protection even if a password leaks.

What you'll learn

How services store passwords (hashes and salts)
The main ways passwords are cracked, and what stops each one
Why making a password longer works better than adding symbols
How multi-factor authentication and passkeys work, and why some methods are stronger than others

Prerequisites: none.

In everyday life

You have probably seen a screen that says, "Use at least 8 characters, with uppercase letters, numbers and symbols." At work, you may be told to change your password every 90 days. And one day, an email may arrive: "Your data was leaked. Please change your password."

Yet today's official guidelines advise against some of these habits. So what works, and what doesn't? Let's start with how passwords are stored and how they get cracked.

Services don't store your password as is

When you log in, the service only needs to check one thing: does this match what you registered? So a well-built service does not store the password itself. Instead, it stores a value calculated from the password.

The calculation uses a hash function. It turns an input of any length into a value of fixed length. The same input always gives the same value, and changing one character gives a completely different value. It is designed so that working back from the value to the input is not practical. The result is called a hash value.

At login, the service runs the password you typed through the same calculation and compares it with the stored hash value. If they match, it treats you as the account owner. Encryption is a way of hiding data that can be undone with a key. A hash has no steps for undoing it at all. That is the big difference.

So the service adds two more protections. The first is a salt. This is a random value, different for each user, that is added to the password before the calculation. Without a salt, everyone with the same password gets the same hash value. An attacker could compute the hash of a common password once and spot many people at a time. With a salt, the attacker must redo the work for each person. The salt does not need to be kept secret.

The second is to use a hash function that is slow on purpose. Ordinary hash functions are built to be fast. For passwords, services use methods that take a lot of time or memory to compute. Well-known examples are bcrypt, published in 1999, and Argon2, chosen in a 2015 competition. If one login takes 0.1 seconds, users don't mind. But for an attacker who wants billions of guesses, it is a heavy burden.

A service stores the result of a calculation, not the password itself. What this figure leaves out: the setting that controls how slow the hash is (it is stored too). Some methods also mix in a separate secret value kept somewhere else, on top of the salt.

Method 1: Guessing common passwords

The simplest method is to try passwords that many people use. In 2019, the UK's National Cyber Security Centre (NCSC), a government agency, analyzed leaked passwords. Around the world, 23.2 million accounts used "123456." "qwerty" and "password" were near the top too.

Trying words, names and common passwords from a list, one by one, is called a dictionary attack. Tools also add variations to the list automatically, such as a "1" or "!" at the end, or "@" in place of "a." Most tricks people come up with, attackers try too.

There are two ways to try guesses. Trying them one at a time on a login screen is slow, because of attempt limits and account lockouts. So some attackers try a few common passwords once each on many accounts. Each account sees only a few failures, so lockouts rarely kick in. This is called password spraying, and it often targets work accounts.

The other way is to steal the hash values from a service and test guesses on the attacker's own machines. Here there is no limit on attempts. With a fast hash function, a single GPU (a chip built for graphics processing) can try billions of guesses per second. This is why the way passwords are stored matters.

Method 2: Brute force, and why length beats symbols

Trying every possible combination in turn is called a brute-force attack. If the characters are chosen at random, how well a password resists this depends on the number of combinations. That number is the count of possible characters, multiplied by itself once for each character in the password.

Uppercase letters, lowercase letters and digits give 62 possible characters. For 8 characters, that is 62 multiplied by itself 8 times, or about 218 trillion. Adding symbols to reach 94 characters makes it only about 28 times larger. But just lowercase letters at 12 characters gives about 440 times as many as 62 characters at 8. Adding one character at a time grows the number far more than adding types of characters.

A passphrase, a string of words, is long but easy to remember. But the words must be chosen at random, for example by rolling dice. Famous quotes and song lyrics are already in dictionary attack lists. Picking 5 words from a list of 7,776 gives about 28 quintillion combinations (see "By the numbers" below).

Method 3: Credential stuffing, which preys on reuse

One of the biggest risks today is reusing passwords. Suppose pairs of email addresses and passwords leak from some service. Attackers then feed that list into the login pages of other services automatically. This is called credential stuffing.

If you reuse a password, a leak at one service spreads the damage to others. What this figure leaves out: with multi-factor authentication turned on, the password alone is not enough to log in to site B either.

If you reuse a password, its length does not help at all. The attacker simply types in the leaked string itself. The defenses are a different password for each service, and multi-factor authentication, explained below. Japan's Ministry of Internal Affairs and Communications, for example, strongly advises against reuse on its public cybersecurity site.

Method 4: Tricking you into typing it on a fake site

A scam that lures you to a fake copy of a real site and gets you to type your password is called phishing. You type the password yourself, so its strength makes no difference. Fake sites often show a padlock too. "What Does HTTPS Mean? What the Padlock Does and Doesn't Do" explains why.

Defense 1: Long and unique, and let a tool remember

No one can remember dozens of long, different passwords, one for each service. That is where a password manager comes in. It creates passwords, stores them encrypted and fills them in on login pages for you. Some are built into browsers and phones.

Most password managers fill in a password only when the site's address matches the one saved. If nothing fills in on a fake site, that can be your clue. But because it keeps everything in one place, the password manager itself becomes a target. Give it a long password you use nowhere else, and turn on multi-factor authentication for it.

Defense 2: Multi-factor authentication and passkeys

There are three broad kinds of proof that you are you. Something you know (such as a password), something you have (such as a phone) and something you are (a fingerprint or face). Combining two or more different kinds is called multi-factor authentication. Even if your password leaks, no one can log in without your phone.

How the code reaches you makes a difference. A code sent by SMS (a text message to your phone number) is much safer than a password alone. But if someone takes over your phone number, they get the code too. Guidance from NIST, a US government body (more below), classes SMS and other methods that use the phone network as "restricted." Codes shown by an authenticator app on your phone do not depend on your phone number. Even so, if you type one into a fake site, it can be used the same way.

Passkeys remove this weakness. With a passkey, your phone or computer holds a secret key for each site. The site keeps only the matching public key. At login, your device uses the secret key to create a "signature" and sends it. A signature is a mark that only the device holding that key can make. The key is tied to the address of the site it was registered with, so it cannot be used on a fake site.

Your fingerprint or face is checked inside the device to unlock the key. It is not sent to the site. Passkeys are based on standards (FIDO2 and WebAuthn) created by the FIDO Alliance, an industry group, and the W3C. In May 2022, Apple, Google and Microsoft jointly announced they would expand support. Some services still don't support them, though. Also check how you would recover access if you lose your device.

How official guidance has changed

NIST (the US National Institute of Standards and Technology) publishes SP 800-63B, its guidelines for checking identity. They are written for US government agencies, but are used as a reference worldwide. The fourth edition (SP 800-63B-4), finalized in July 2025, includes these main rules.

Require at least 15 characters when a password alone is used to log in, or at least 8 when it is part of multi-factor authentication
Allow passwords of 64 characters or more (recommended)
Do not impose rules on character types, such as "must include a symbol"
Do not require periodic changes, but force a change if there is evidence of a leak
Check passwords against lists of common or leaked ones, and reject any that match
Allow password managers (allowing pasting is recommended)

Japan's Ministry of Internal Affairs and Communications gives similar advice on its Cybersecurity Site for the Public (revised in May 2024). It says there is no need to change passwords regularly unless they have leaked. It also recommends not reusing passwords and using a tool to manage them. For length, it recommends at least 10 characters in a random order.

The ministry also calls a mix of digits, symbols, and uppercase and lowercase letters "preferable." What NIST forbids is forcing such a mix as a rule. Both put the weight on passwords being long and hard to predict.

Common myths

Myth: Changing your password every 90 days makes it stronger

In fact, when forced to change, people tend to make small tweaks, such as turning "Spring2026!" into "Spring2027!" Attackers try these tweaks as well. Changing a password that has not leaked does not make it stronger. Both NIST and the Japanese ministry advise changing a password right away when it leaks.

Myth: Swapping letters, as in "P@ssw0rd," makes a password strong

In fact, swaps like "a→@" and "o→0" are standard tricks that dictionary attack tools try automatically. It may look complex, but if it starts from a dictionary word, it is found quickly. What decides strength is how hard it is to predict, and its length.

Myth: The site uses HTTPS encryption, so my password is safe

In fact, HTTPS only protects the password on its way to the site. If the stored data is stolen from the service, the hash values can be tested on the attacker's machines. Weak passwords are cracked there. And if you type your password into a fake site, HTTPS delivers it straight to the scammer.

By the numbers

We calculated how long a brute-force attack would take to try every combination. The characters or words are assumed to be chosen at random. On average, the right one turns up in half this time. We assumed two guessing speeds.

Fast hash: 10 billion guesses per second (a rough figure for one GPU against a fast method. A 2025 benchmark also showed one GPU making more than 160 billion guesses per second against MD5, one of the fast methods)
Slow hash: 10,000 guesses per second (a rough figure for one GPU against bcrypt or similar at a practical setting)

Password	Combinations	Fast hash	Slow hash
8 lowercase letters	About 210 billion	About 21 seconds	About 240 days
8 characters: upper, lower and digits	About 218 trillion	About 6 hours	About 690 years
8 characters including symbols	About 6.1 quadrillion	About 7 days	About 19,000 years
12 lowercase letters	About 95 quadrillion	About 110 days	About 300,000 years
4 random words	About 3.7 quadrillion	About 4 days	About 12,000 years
5 random words	About 28 quintillion	About 90 years	About 90 million years

The words are assumed to come from a list of 7,776. The table shows that adding length works better than adding symbols. Under these assumptions, the way a password is stored also changes the time by a factor of a million. Real speeds depend on the hash method and the attacker's hardware, so treat the table as a rough guide. And common passwords like "123456," or reused ones, are cracked instantly, whatever this math says.

Learn more

Change the character types, length and guessing speed and calculate for yourself: the password brute-force time calculator
Measuring the number of combinations in "bits": entropy (a measure of how hard something is to predict)
The technology behind passkeys: public-key cryptography and digital signatures
Tricking people into giving away information: social engineering
Why multi-factor authentication became standard at work: Perimeter Security vs Zero Trust