What actually happens when someone “cracks” a password
Cracking isn’t a hacker typing guesses at a login box. It’s math run on a stolen file, and understanding it explains every password rule worth following.
6 min read · Reviewed August 2026
Movies show password cracking as someone hammering guesses into a login screen until one works. That almost never happens, because that path is slow and easy to block. The real attack looks nothing like it, and once you picture the real version, every piece of password advice suddenly makes sense.
Guessing at a live login barely works
Type a wrong password a few times and the site slows you down, shows a captcha, or locks the account. A remote attacker guessing one account at a time gets almost nowhere. So they don’t. The only version of live guessing that pays off is credential stuffing: taking email and password pairs leaked from one site and trying them on others, betting you reused one. That bet wins constantly, which is the whole argument for never reusing a password.
The real game is offline, on stolen files
When a company gets breached, attackers often walk away with its stored password file. Now the rules change completely. There’s no lockout, no rate limit, no site watching. They run the file on their own graphics cards and test hundreds of billions of guesses per second. And they don’t start with random strings. They start with lists of real leaked passwords, then dictionary words, then common patterns, then the predictable substitutions like a to @ and o to 0.
That order is exactly why P@ssw0rd! falls in under a second while a random 16-character string survives longer than the planet. The clever password sits near the top of the guess list. The random one isn’t on any list at all, so the attacker has to grind through an impossibly large space to reach it.
What this buys you in plain terms
Two properties defeat the two attacks. Length and randomness beat offline cracking, because they blow up the search space past what the hardware can chew through. Uniqueness beats credential stuffing, because a password stolen from one site opens nothing else. A generator plus a password manager gives you both at once, on autopilot. Everything else in password advice is a footnote to those two ideas.