Passwords and how they get cracked.
Weak and reused passwords are still one of the easiest ways into accounts. Today you'll learn exactly how attackers crack them, what makes a password truly strong, and the two tools that protect you best.
How websites store passwords
A good website never stores your actual password. It stores a hash: the result of putting your password through a one-way mathematical blender. "Hyderabad@123" goes in, and a long string of random-looking characters (like 9e1c4a…77b2) comes out. You can't turn the hash back into the password.
When you log in, the site blends what you typed and compares the two hashes. If they match, you're in.
So how do attackers crack them?
When a website gets hacked, attackers steal the list of hashes. They can't reverse them, so they guess: blend millions of guesses and see which hash matches.
| Attack | How it works | Beats which passwords |
|---|---|---|
| Brute force | Try every combination: aaaa, aaab, aaac… | Short ones (under 8 characters) |
| Dictionary attack | Try real words and common passwords from huge lists | password, iloveyou, hyderabad |
| Rules / hybrid | Dictionary words with common changes | Hyderabad@123, P@ssw0rd, Ali2004! |
| Credential stuffing | Take emails + passwords leaked from one site, try them on other sites | Any password you reused |
It looks complex (capital, symbol, numbers) but it follows the most common human pattern: Word + @ + 123. Cracking tools try exactly these patterns first. Modern graphics cards can test billions of guesses per second against weak hashes.
Your Swiggy password leaked in a data breach. You used the same password for Gmail. What attack should you worry about?
Leaked logins get tried automatically on Gmail, Instagram, banks and more. That's why reusing a password is so dangerous: one breach opens many doors.
What actually makes a password strong
Length beats complexity. A long passphrase made of random words is both strong and easy to remember:
| Password | Why |
|---|---|
| Ali@2004 | Weak: short, name + year, common pattern |
| Tr0ub4dor&3 | Medium: complex but short, hard to remember |
| biryani-kite-monsoon-ladder | Strong: 4 random words, 27 characters, easy to remember |
The words must be random, not a famous sentence or song line.
The two tools that protect you best
1. A password manager
You can't remember 50 different long passwords. Nobody can. A password manager remembers them for you, creates random ones, and fills them in. Google Password Manager (built into Chrome and Android) and Bitwarden (free) are good choices. You remember one strong master passphrase.
2. Two-factor authentication (2FA)
2FA means logging in needs two things: something you know (password) + something you have (your phone). Even if your password leaks, the attacker is stuck.
Which setup is the most secure?
Unique passwords stop credential stuffing; 2FA stops attackers even when a password leaks.
Module 2 test
Which step of the kill chain is "collecting information about the target"?
Reconnaissance is step 1: research before the attack.
"Bhai, urgent, send ₹5,000 on GPay, will return tonight" from a friend's account. Which trick is this mainly using?
Attackers use hacked accounts to ask friends for "urgent help". Always call the friend to check.
What is the real domain in https://paytm.com.cashback-offer.in/claim ?
Read right to left before the first "/": cashback-offer.in.
Which malware spreads across a network by itself, without anyone clicking?
Worms self-spread, often through unpatched systems.
In the 3-2-1 backup rule, what does the "1" mean?
The offline/off-site copy is what survives ransomware.
Why is reusing a password dangerous?
Credential stuffing tries leaked logins everywhere automatically.
Your task (20 min)
Open haveibeenpwned.com and enter your email to see if it appeared in known data breaches. Then turn on a password manager (Google Password Manager is already in Chrome) and change the passwords of your 3 most important accounts (email, Instagram, bank) to unique ones. Finally, switch your Gmail 2FA from SMS to the Google Authenticator app or a passkey.
Lesson 8 complete!
You understand hashing, brute force, dictionary attacks and credential stuffing, and you know the real fixes: long passphrases, a password manager and 2FA. You also finished Module 2!
Next: Firewalls and VPNs →