DataTerminology.comNEW
Methods to recover passwords from stored or transmitted data using brute force, dictionaries, heuristics, or exploitation of implementation weaknesses.
DESCRIPTION
Password cracking targets authentication secrets by exploiting weak storage, poor password choices, and offline attack feasibility. Techniques include brute force, dictionary attacks, rule-based mutations, rainbow tables, and password spraying. Strong mitigations are salted, slow hashes, MFA, rate limiting, and monitoring for credential leaks. Compliance frameworks mandate secure storage and breach response. Organizations should enforce robust policies and educate users to reduce attack success.
ALTERNATIVE DEFINITIONS
Wikipedia
Password cracking is the process of recovering passwords from data that has been stored in or transmitted by a computer system.
Highlights recovery from stored or transmitted password-related data.
OWASP
This cheat sheet provides guidance on secure password storage to prevent offline attacks including brute-force and precomputed dictionary attacks.
Focuses on secure storage to mitigate offline cracking attacks.
RELATED TERMS
Rainbow Table Dictionary Attack Brute-Force Attack Credential Stuffing Salt bcrypt scrypt Argon2
COMPETING TERMS
Password Hashing Multi-Factor Authentication
RELATIONS
- Narrower: Brute-Force Attack
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Chief Information Security Officer IT Auditor Software Developer
EXTERNAL SOURCES
- Wikipedia - Password cracking
- NIST SP 800-63B - Guidance on authentication and password storage
- OWASP - Best practices to mitigate password attacks
TOP QUESTIONS
What makes Password Cracking feasible for attackers?
Weak or reused passwords, unsalted fast hashes, and offline access to password databases enable rapid guessing and recovery.
Category: Risks
Which techniques are common in Password Cracking?
Brute force, dictionary attacks, rule-based mutations, rainbow tables, spraying, and leveraging leaked credential datasets.
Category: Overview
How to prevent Password Cracking in practice?
Use salted, slow hashing (bcrypt/scrypt/Argon2), MFA, rate limits, and breach monitoring with credential hygiene policies.
Category: BestPractices
What is a common mistake regarding Password Cracking defenses?
Relying on fast hashes like SHA-256 without salt or ignoring MFA and rate limits exposes systems to offline attacks.
Category: Mistakes
How do standards address Password Cracking?
NIST 800-63B recommends secure storage, password blacklists, and MFA to mitigate offline and online attacks.
Category: Standards
Why are memory-hard functions crucial against Password Cracking?
They raise resource costs per guess, limiting attacker throughput and making large-scale cracking economically impractical.
Category: Relevancy
What role does user education play in Password Cracking prevention?
Educating on unique, strong passwords and phishing risks reduces attack success even with robust technical controls.
Category: Management
How should teams respond to suspected Password Cracking?
Force credential resets, enable MFA, monitor auth events, and investigate data exfiltration or lateral movement.
Category: Management
Is Password Cracking always illegal?
Unauthorized cracking is illegal; controlled testing in red teams or audits must be sanctioned and scoped.
Category: Compliance