In films, cracking looks like fast typing on a black screen. In reality it is four rather dull methods, and only one of them involves guessing your password at all. Here is each: what it threatens, how fast it runs and what actually stops it.
- Replaying leaked pairs62%
- Phishing and fake pages21%
- Malicious software9%
- Dictionary guessing6%
- Full brute force2%
The shares are approximate and vary between reports, but the order of magnitude holds: full brute force is the smallest slice — and it is the one password length defends against. Uniqueness defends against the largest.
Method 1. Brute force
The program tries every combination in order: aaaa, aaab, and so on. It needs no knowledge of the victim — but it runs into arithmetic.
- Through a login form — hundreds of attempts per second, and only until the first lockout. Practically useless.
- Offline against a stolen hash database — tens of billions of attempts per second on a single graphics card.
- On a rented farm — up to 10¹⁴ attempts per second, if the attacker can afford it.
Hence the rule: length decides everything. Each extra character multiplies the work by the alphabet size, and at sixteen characters brute force stops existing as a threat.
Method 2. Wordlists with rules
The most productive method against real people. Take a list of a billion passwords from past breaches and apply transformation rules to each: append a year, swap “o” for zero, capitalise the first letter, add an exclamation mark.
Someone forced to change their password every three months does not invent a new one — they append a digit to the old one. Cracking rules are built for exactly that.
So “Summer2026!” falls in seconds rather than years: it is not random, it is predictably modified. More on this in what to do if your password leaked.
Method 3. Credential stuffing
Nothing is guessed. A database of login-and-password pairs from one breach is replayed against hundreds of other sites. People reuse passwords, so a share of the pairs works.
It is the most widespread attack on the internet and also the cheapest: it needs requests, not computation. Password length does not help here at all — the password is already known.
The only defence is uniqueness, and without a password manager it is unachievable: forty random strings do not stay in anyone’s head.
Method 4. Phishing
The password is not guessed; it is handed over on a page that looks genuine. Neither length nor uniqueness helps here, and neither does a code from an app if you type it into the fake page yourself.
The signs of a fake and what actually protects you are covered in the article on phishing.
The methods compared
| Method | What the attacker needs | What defends you |
|---|---|---|
| Brute force | A stolen hash database and computing power | Length from 16 characters |
| Wordlist with rules | A hash database and lists of past breaches | Randomness rather than “complexity” |
| Credential stuffing | One breach elsewhere and nothing more | A unique password per service |
| Phishing | A convincing page and a moment of inattention | Checking the address, a manager, a hardware key |
What follows from this
- Uniqueness beats length. No length saves you from credential stuffing, and that method is used more than all the others combined.
- Randomness beats “complexity”. Demanding a capital, a digit and a symbol produces predictable passwords that wordlist rules catch.
- A second factor closes three methods out of four. A stolen or guessed password is useless without it.
- Check what already leaked. The breach check shows whether your password sits in the very lists every attack starts from.