How Passwords Get Cracked

Hello, and welcome to In Simple Terms with Satish.

Earlier this month, KDDI in Japan reported unauthorized access to an email system it provided for internet service providers.

In its July 6 report, KDDI said more than 12 million email addresses and more than 7.6 million passwords were confirmed leaked.

That headline raises a question most of us never ask:

when a company says passwords leaked, what actually leaked?

Was it the readable password?

Was it a scrambled version?

And how does a scrambled password still become dangerous?

Start with the worst design.

A bad system stores your password as plain text.

If that database leaks, there is nothing to crack.

The password is just exposed.

But a well-built website should not know your password at all.

When you create one, the site should run it through a one-way mathematical function and store only the result.

That result is called a hash.

Think of it as a fingerprint of the password.

At login, the site hashes what you type and checks whether the new fingerprint matches the stored fingerprint.

So password cracking is usually not someone reversing the hash like opening a locked box.

Good hashes are designed to be one-way.

Instead, attackers guess.

They take a candidate password, hash it the same way, and compare fingerprints.

If the fingerprints match, the guess was right.

There are two worlds here.

Online guessing happens against a live website.

The site can slow attempts, lock accounts, require MFA, detect unusual traffic, or block repeated failures.

It is like trying keys at the front door while the building can see you.

Offline cracking is different.

If attackers steal a database of password hashes, they can guess on their own machines, away from the website's rate limits.

That is why storage design matters.

A hash alone is not enough.

Each password also needs a salt.

A salt is unique random data added before hashing.

So if two people choose the same password, their stored hashes still look different.

Salt also makes giant precomputed lookup tables much less useful.

Important detail:

the salt does not have to be secret.

Its job is not to hide the password.

Its job is to make every account a separate guessing problem.

Then speed matters.

Fast hash functions are useful for file checks and data integrity.

They are dangerous for password storage.

If each guess is cheap, attackers can test huge numbers of guesses quickly using specialized hardware or rented cloud machines.

That is why password systems use slow, purpose-built algorithms such as Argon2id, bcrypt, or PBKDF2.

For one real login, the delay can be tiny.

For millions of guesses, the cost becomes painful.

This is why password security is not only about whether the password looks complicated.

It is about entropy, storage design, and attacker cost.

Attackers also do not start with random nonsense.

They start with human behavior:

reused passwords, old breach lists, common words, names, years, keyboard patterns, and small changes like adding a number or symbol.

That is why "Summer2026!" can look strong to a human but still be predictable to a guessing system.

There is another problem: credential stuffing.

If one leaked email-password pair works on your shopping site, cloud storage, or recovery email, one breach becomes many breaches.

No cracking breakthrough is needed.

Just reuse.

So the personal defense is simple:

use long, unique passwords, let a password manager create them, and turn on MFA or passkeys where possible.

For builders, the rule is harsher:

never store plain text passwords.

Use salted, slow password hashing.

Block known-bad passwords.

Rate-limit logins.

Watch for credential stuffing.

And design as if one database might someday leak.

In simple terms, passwords usually get cracked when guessing becomes cheap.

Good security makes every guess slow, isolated, and less useful.

That is the mental model:

a password hash is a fingerprint.

Cracking is matching fingerprints by guessing.

And reuse is how one cracked password opens doors it was never meant to open.

If this helped you understand the topic in simple terms, follow or subscribe to In Simple Terms with Satish, and share this episode with one friend who likes technology. I will see you in the next episode.

Download plain-text transcript