How Password Cracking Works: A Step-by-Step Guide

Password cracking is the process of recovering passwords from data that has been stored or transmitted in a hashed or encrypted form. This guide explains the common techniques attackers use, the tools involved, and how to defend against them. It is intended for educational purposes and to help you secure your own accounts.

What You’ll Need

A computer with a modern operating system (Windows, macOS, or Linux).
Basic command-line familiarity.
For practice only: a hash you generated yourself (e.g., from a test password using an online hash generator or a tool like htpasswd).
Optional: a GPU (graphics card) for faster cracking, but CPU-only works for learning.

Step-by-Step

Understand the target format. Passwords are rarely stored as plain text. They are typically hashed (e.g., MD5, SHA-1, bcrypt) or encrypted. Identify the hash type by its length and format. For example, MD5 hashes are 32 hex characters, SHA-1 are 40, and bcrypt strings start with $2.
Obtain the hash. In a real attack, this might come from a data breach dump or a stolen database. For practice, create your own: choose a simple password like “password123” and generate its MD5 hash online or with a tool like echo -n "password123" | md5sum on Linux/macOS.
Choose a cracking tool. Popular tools include Hashcat (GPU-accelerated) and John the Ripper (CPU-based). Install one. On Linux, use your package manager (e.g., sudo apt install hashcat). On Windows, download the binaries from the official site.
Prepare a wordlist. A wordlist is a file containing candidate passwords. Common lists include rockyou.txt (found in Kali Linux or downloadable from many sources). You can also create a custom list with common passwords like “123456”, “password”, “qwerty”.
Run a dictionary attack. This tries every word in the list against the hash. For Hashcat, the command is: hashcat -m 0 -a 0 hash.txt rockyou.txt where -m 0 specifies MD5, -a 0 is dictionary attack, hash.txt contains your hash, and rockyou.txt is the wordlist.
Try a brute-force attack. If the dictionary fails, brute-force tries every possible combination of characters up to a length. For MD5 with all lowercase letters up to 6 characters: hashcat -m 0 -a 3 hash.txt ?l?l?l?l?l?l. This is much slower, so use a short length for practice.
Use rule-based attacks. To crack variations like “Password123”, apply rules that modify words (e.g., append digits, capitalize). Hashcat allows -r rules/best64.rule.
Analyze the output. When a hash is cracked, the tool displays the plaintext password. For Hashcat, it shows as hash:password in the output or in the potfile.
Check for rainbow tables (if applicable). For unsalted hashes, precomputed tables can reverse them instantly. Tools like rcrack use these, but modern systems use salts to defeat this.

Common Mistakes

Using the wrong hash type. If you specify MD5 but the hash is SHA-256, the tool will fail or produce false matches.
Ignoring salts. Real systems often prepend a random salt to the password before hashing. Without the salt, you cannot crack the hash even with the correct password.
Using a tiny wordlist. A list with only 10 words will rarely succeed. Use a comprehensive list like rockyou (14 million entries).
Running GPU attacks on a laptop. Overheating can cause errors or hardware damage. Monitor temperatures.
Not checking the potfile. Hashcat saves cracked hashes to ~/.hashcat/hashcat.potfile. If you rerun, it may skip already cracked ones.

Tips

Start with the easiest attack. Dictionary before brute-force saves time.
Use masks for known patterns. If you know the password is 8 characters with an uppercase letter and two digits, use a mask like ?u?l?l?l?l?l?d?d.
Leverage GPU acceleration. Hashcat on a modern GPU is thousands of times faster than CPU.
Learn to read hashcat benchmarks. Run hashcat -b to see your device’s speed for different hash types.
Use online hash databases for practice. Websites like CrackStation can reverse unsalted hashes, but they are not for real attacks.

Troubleshooting

“No devices found” error. Ensure your GPU drivers are installed and that Hashcat is compiled for your hardware (OpenCL or CUDA). Try CPU-only mode with --force if needed.
Hashcat says “Separator unmatched”. Your hash file may have extra spaces or a missing colon. Ensure each line is just the hash, with no trailing characters.
Attack runs but never finds the password. The password may be too complex or not in your wordlist. Increase length in brute-force or use a larger wordlist.
John the Ripper gives “No password hashes loaded”. Check the file format. John expects a specific format like username:hash or a raw hash with --format=raw-md5.
System freezes or crashes. Reduce the workload: lower the number of threads (-t in John) or use a smaller mask. Ensure adequate cooling.

Frequently Asked Questions

Is password cracking illegal? It depends on intent. Cracking your own passwords or with explicit permission is legal. Attempting to access others’ accounts without consent is illegal in most jurisdictions.
How long does it take to crack a password? It varies wildly. A simple 6-character lowercase password can be cracked in seconds on a GPU. A 12-character password with mixed case, numbers, and symbols could take centuries with current hardware.
What is a salt and why does it matter? A salt is a random string added to the password before hashing. It prevents identical passwords from producing the same hash and defeats rainbow tables. Without the salt, cracking becomes much harder.
Can I crack a password without a wordlist? Yes, brute-force and mask attacks don’t need a wordlist, but they are slower. For short passwords, brute-force is feasible.
Why do some hashes crack instantly? Because they are unsalted and the password is common. Tools like Hashcat check against a large dictionary first, and if the password is in it, the match is immediate.
How can I protect myself from password cracking? Use long, random passwords (at least 12 characters), enable two-factor authentication, and use a password manager. Also, ensure websites use salted hashing algorithms like bcrypt.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →