Password Strength Evaluation: How Cracking Tools Guess Passwords

Cybercriminals and security auditors evaluate password strength using automated hash-cracking software such as Hashcat and John the Ripper. Understanding exactly how these tools operate — and why some hashes fall in seconds while others resist attack for centuries — helps you build passwords that hold up against real threats, not just checkbox complexity rules.

Direct Answer: Password crackers don't guess passwords through login forms, which lock accounts after a handful of failed attempts. Instead, attackers who've stolen a database of password hashes run the cracking process offline, testing billions of candidate passwords per second, computing each candidate's hash, and comparing it against the stolen hash list. A match reveals the original plaintext password without ever touching the live login system.

How Offline Password Cracking Works

Stolen Hash Database ──► Hashcat / John the Ripper ──► Generate Guess ──► Compute Hash ──► Compare to Stolen Hash ──► Match Found!

Because this process runs entirely on the attacker's own hardware, there's no rate limit, no account lockout, and no alert — the only defense is making the hash itself too slow or the keyspace too large to search in a practical amount of time.

Attack Strategies, in Order of Real-World Effectiveness

1. Dictionary attacks. Tests millions of passwords pulled from historical breach corpora (like the leaked RockYou.txt list of roughly 14 million real passwords). This alone cracks a surprising share of real-world accounts, because password reuse and common patterns are extremely widespread.
2. Rule-based / hybrid attacks. Takes dictionary words and systematically mutates them — appending years (2026!), capitalizing the first letter, and applying leetspeak substitutions (a→@, e→3). Hashcat ships with rule files containing thousands of these mutation patterns, which is why "complex-looking" passwords like P@ssw0rd2026! are cracked almost instantly — they're one of the first mutations tried.
3. Mask attacks. Targets a known or guessed structure, such as "uppercase letter, four lowercase letters, four digits" (written as a Hashcat mask: ?u?l?l?l?l?d?d?d?d). Useful when an attacker knows a site's password policy.
4. Combinator attacks. Concatenates pairs of dictionary words together, targeting exactly the kind of two-word passphrase many users assume is safe.
5. Pure brute-force attacks. Systematically tests every possible character combination up to a given length. This is the slowest strategy and is really only practical against short passwords or as a last resort after dictionary and rule-based attacks fail.

In practice, real cracking sessions run these in order of cost-effectiveness — dictionary and rule-based attacks first, since they crack the largest share of passwords for the least computation, with brute force reserved for what's left.

GPU Hash Cracking Speed Comparison

The single biggest factor in whether a password survives an offline attack is which hashing algorithm protected it, not just the password's own entropy. Modern consumer GPUs (e.g. an NVIDIA RTX 4090) can compute enormous numbers of fast, unsalted hashes per second, but deliberately slow, memory-hard algorithms shrink that rate by six or more orders of magnitude:

Worked Example: Combining Entropy and Hash Speed

An 8-character password using the full 95-character printable ASCII set has entropy of 8 × log₂(95) ≈ 52.6 bits, meaning a keyspace of 2^52.6 ≈ 7.1 × 10^15 possible passwords.

• Against MD5 at 150 billion guesses/sec: 7.1×10^15 ÷ 1.5×10^11 ≈ 47,600 seconds ≈ 13 hours to exhaust the entire keyspace.
• Against bcrypt (cost 12) at 100,000 guesses/sec: 7.1×10^15 ÷ 1×10^5 ≈ 7.1×10^10 seconds ≈ 2,250 years.

The password's entropy didn't change at all between these two scenarios — only the hashing algorithm did. This is why the choice of hashing algorithm on the server side matters as much as password strength itself; see our password entropy math guide for how to calculate the entropy side of this equation for any password.

Why Salting Matters

A salt is a unique random value generated per password and stored alongside its hash. Salting defeats rainbow tables — massive precomputed lookup tables mapping common passwords to their hash outputs — because it forces the attacker to compute (or look up) a hash for that specific salt value, rather than reusing one precomputed table against every account in the database. Without salting, two users who both chose Password123 would have identical hashes, letting an attacker crack both accounts with a single precomputed lookup; with unique salts, those two hashes are completely different strings even though the underlying password is the same.

What Actually Slows Down a Password Cracker

• A slow, purpose-built hash algorithm (bcrypt, scrypt, Argon2id) matters more than almost anything else, because it directly divides the attacker's guesses-per-second by orders of magnitude.
• Unique, random salting prevents precomputed rainbow-table attacks and stops one cracked password from exposing every account sharing that password.
• High entropy (length over complexity — see our entropy calculation guide) still matters, especially against attackers who've already exhausted dictionary and rule-based attacks.
• Avoiding leaked passwords entirely matters more than raw entropy, since dictionary attacks check known-breached passwords before anything else — a high-entropy password that happens to already be in a breach corpus offers no real protection.

Evaluate your own password's resilience against real cracking dictionaries with our password strength checker, generate high-entropy replacements with the password generator, compute and compare hash outputs using the hash generator, and encode tokens safely with the Base64 encoder/decoder.

Frequently Asked Questions

What is a password salt?

A salt is a unique random string generated for each password and combined with it before hashing. Salting ensures that two users with the identical password produce completely different stored hashes, which defeats precomputed rainbow-table attacks.

Why do "complex" passwords with symbols still get cracked quickly?

Because rule-based attacks specifically target common complexity patterns — capitalized first letters, a symbol at the end, digit-for-letter substitutions. A password that looks complex to a human but follows a predictable pattern is often one of the first thousand guesses a cracking tool tries.

Can a strong hashing algorithm make even a weak password safe?

It helps enormously but isn't a complete substitute for entropy. A slow hash like bcrypt raises the cost of every guess, but a short, dictionary-based password can still fall relatively quickly to a targeted dictionary or mask attack, just far more slowly than against a fast hash like MD5.

How fast can attackers try passwords directly on a login page?

Well-built login systems rate-limit or lock accounts after a small number of failed attempts (often 5–10), making online guessing impractical for any password with meaningful entropy. This is why virtually all large-scale cracking happens offline, against stolen hash databases, not through login forms.

What's the difference between a dictionary attack and a brute-force attack?

A dictionary attack tests a curated list of real, previously-seen passwords (and their common mutations), which is highly efficient against human-chosen passwords. A brute-force attack tests every possible character combination systematically, which is exhaustive but far slower — it's typically reserved for short passwords or used after dictionary attacks are exhausted.

References: OWASP Password Storage Cheat Sheet.