Passwords are not usually broken by someone staring at a login screen until inspiration strikes. Attackers rely on automation, leaked credentials, predictable human choices, and weaknesses in the way a service stores or protects authentication data.
Understanding the difference between online guessing and offline cracking explains why some defenses work—and why a password that feels complicated may still be easy to uncover.
Online Guessing
An online attack sends guesses to a real login page. Because every attempt must reach the service, defenders can slow it with rate limits, temporary lockouts, suspicious-login detection, and multi-factor authentication.
A brute-force attack tries many possible combinations. A dictionary attack starts with likely words and common patterns. Password spraying tests a small number of popular passwords across many accounts, avoiding the repeated failures on one account that often trigger a lockout.
Credential Stuffing
Credential stuffing does not begin by guessing. It uses usernames and passwords exposed in an earlier breach and automatically tests them on other websites. It succeeds because people often reuse the same password.
A strong password cannot protect a second account if that exact password was already stolen elsewhere. Every important account needs a unique password, which is one reason a password manager is more practical than memorizing small variations.
Offline Cracking and Password Hashes
Responsible services do not store passwords as readable text. They process each password with a one-way function and store the resulting hash. During login, the service hashes the submitted password and compares the result.
If attackers steal a password database, they may work offline. They can calculate hashes for candidate passwords on their own hardware and compare them with the stolen records. There is no login page to lock them out, so the quality of the password and the storage method become crucial.
Why Salts and Slow Hashes Matter
A salt is a unique random value combined with a password before hashing. It prevents identical passwords from producing identical stored results and makes precomputed lookup tables far less useful.
Password-specific hashing methods are deliberately expensive to calculate. That small delay is acceptable during a normal login but costly when an attacker wants to test billions of guesses. Modern systems should use a suitable password-hashing algorithm with carefully selected settings rather than a fast general-purpose hash.
Patterns Attackers Test First
Attack tools prioritize choices people commonly make: dictionary words, names, dates, keyboard patterns, repeated characters, and predictable substitutions such as replacing a letter with a number. They also combine words with familiar endings and use rules learned from previous leaks.
This is why adding one capital letter, one number, and one symbol does not automatically create a strong password. Length and unpredictability matter more than cosmetic complexity. A long, randomly generated password or a genuinely random passphrase gives an attacker a much larger search space.
How to Protect Your Accounts
Use a password manager to generate and store a different long password for every account. Protect the manager itself with a strong master password and enable multi-factor authentication wherever it is offered.
Prefer phishing-resistant authentication methods such as passkeys or security keys when a service supports them. Keep recovery email accounts secure, save backup codes safely, and change a password promptly if the service reports a breach or the credential appears in a known leak.
The best password is not merely difficult to remember—it is unique, long, and difficult for software to predict.
For service owners, the defense is layered: secure password hashing, unique salts, rate limiting, breach-password screening, multi-factor authentication, useful alerts, and safe account recovery. No single control is enough on its own.