How Password Cracking Works
Password cracking takes several forms. Dictionary attacks try common words and known passwords from previous breaches. Brute force tries every possible combination. Hybrid attacks combine dictionary words with common substitutions (@ for a, 0 for o). Rainbow tables use pre-computed hash lookups.
Modern GPUs can test billions of password hashes per second. An 8-character password using all character types can be cracked in under an hour. A 16-character truly random password would take centuries. The difference is entropy — the mathematical measure of unpredictability.
Why Simple Rules Fail
Most websites check passwords against simple rules: “must have uppercase, a number, and a symbol.” But attackers know these rules too. “P@ssw0rd!” passes every rule-based checker but is in every password cracking dictionary. It would be cracked in seconds.
Our checker uses zxcvbn, developed by Dropbox and presented at USENIX Security 2016. It evaluates passwords the way attackers actually work — detecting dictionary words, common names, dates, keyboard sequences, l33t substitutions, and repeated patterns. This produces far more accurate strength estimates than rule-based checking.