Passwords &
password managers

How hackers actually crack passwords

Nobody sits and guesses your password by hand. Three automated methods account for virtually every compromised account:

1. Credential stuffing — the leaked password

The most common method requires no cracking at all. When one service is breached, your exact credentials — email plus password — are automatically tried against hundreds of other services. OWASP describes the technique in detail; it works for one reason only: people reuse passwords.

2. Dictionary attacks — the predictable password

Cracking tools try millions of known words, names, dates and patterns — including every classic substitution ("P@ssw0rd") and the capital-letter + word + digits + exclamation-mark structure. If your password is built on a real word, it falls here.

3. Brute force — the short password

Pure raw power: try every combination. Modern graphics cards test billions of candidates per second against a stolen password database. Security firm Hive Systems publishes a yearly table of cracking times: a random 8-character password falls in hours — a 16-character one takes longer than the age of the universe.

Length beats complexity — every time

Decades of "at least one capital letter, one digit and one special character" taught us to build passwords that are hard for humans to remember but easy for computers to crack. The US standards institute NIST reversed the recommendation long ago: length matters most, and convoluted complexity rules plus forced rotation do more harm than good.

The comic classic xkcd 936 sums it up: four random words are both easier to remember and vastly harder to crack than "Tr0ub4dor&3".

For the passwords you must know by heart (there will only be two or three — more on that shortly): use a passphrase of five random words. To do it properly, use EFF's dice method with word lists. The rest of your passwords you should never need to remember — that's the whole point of the next section.

Password managers — and which one to pick

A password manager is an encrypted vault that creates, stores and fills in unique random passwords for you. You remember one master password (your five-word passphrase) — the vault handles the rest. It is the single biggest security upgrade a private individual can make.

Three recommended options, all with a free tier or a low monthly cost, independently audited, with apps for every platform:

Service	Strengths	Keep in mind
Bitwarden	Open source, generous free tier, cheap premium tier. Our first pick for most people.	The interface is functional rather than pretty.
1Password	The most polished apps, excellent family features, a "Secret Key" as an extra protective layer.	No free tier — subscription required.
Proton Pass	From Switzerland's Proton (more in episode 12), built-in email aliases, good free tier.	A younger product with fewer features than the other two.

What about the browser's built-in password saver? Better than reuse — but a real manager is locked behind its own master password, works across every browser and app, and warns you when your passwords show up in breaches via services like Have I Been Pwned.

The LastPass lesson

"But what if the manager itself gets hacked?" Fair question — it has happened. During 2022, LastPass suffered a series of breaches in which attackers eventually obtained customers' encrypted vaults. Users with strong master passwords were fine — their vaults stayed uncrackable. Users with short or reused master passwords had their vaults opened, and crypto thefts have since been linked to the leak.

Three lessons:

• The master password is everything. A strong five-word passphrase makes your vault worthless to an attacker even if the entire database is stolen.
• Pick a provider with a good track record. LastPass was criticised for poor communication and weak crypto settings on older accounts. Bitwarden, 1Password and Proton publish independent audits.
• Even the worst case still beats reuse. A cracked vault is a disaster — but reused passwords are the same disaster, guaranteed and ongoing.

Up and running in half an hour

You don't need to migrate 200 accounts tonight. Here's the realistic plan:

1. Create your passphrase (5 min). Five random words. Write it on paper and store it safely at home — that's allowed; a post-it on your monitor is not.
2. Get the manager (5 min). Create an account with e.g. Bitwarden, install the browser extension and the mobile app.
3. Secure email first (10 min). Generate a new random password for your email account and save it in the vault. Email is the master key from episode 1 — it always goes first.
4. Then the bank and the breached accounts (10 min). Next, the accounts that showed up in your HIBP search from the previous episode.
5. The rest as you go. Every time you log in somewhere from now on: let the manager generate a new password. Within a month or so everything is migrated — without a single marathon evening.

Sources

Want to dig deeper? These are the sources behind this episode.

1. NIST — SP 800-63B: Digital Identity Guidelines — the standard behind "length over complexity".
2. OWASP — Credential stuffing — technical description of the attack.
3. Hive Systems — Password Table — yearly table of cracking times per password length.
4. xkcd — Password Strength (#936) — the passphrase classic.
5. EFF — Dice-generated passphrases — the dice method with word lists.
6. Bitwarden — bitwarden.com — open source, free tier.
7. 1Password — 1password.com — subscription, family features.
8. Proton — Proton Pass — email aliases, free tier.
9. Troy Hunt — Pwned Passwords — check whether a password appears in known breaches.
10. Wikipedia — LastPass security incidents — summary of the 2022 breach.
11. Krebs on Security — krebsonsecurity.com — ongoing coverage of, among other things, the LastPass aftermath.
12. Verizon — Data Breach Investigations Report — stolen credentials as the most common way in.
13. Microsoft — Password policy recommendations — modern password advice in practice.
14. CERT-SE — cert.se — Swedish government advice and alerts.