PhraseForge knowledge library
How attackers actually crack passwords today
Password cracking is mostly a cost problem. Attackers start with whatever route avoids expensive guessing for the longest time. That is why old leaks, ranking models, replay, phishing, and session theft matter so much. They keep the attacker away from the hard path, and modern attack practice is built around that preference rather than around the cinematic fantasy of endless random guessing.
What the high-risk case really is
The most dangerous guessing usually begins after password hashes have already been stolen. At that point rate limits, captchas, and account lockouts are irrelevant because the attacker no longer needs the service. The work happens locally with attacker hardware and attacker tooling. That is why verifier-side design matters so much. Strong password hashing changes the economics of every guess. It does not rescue weak secrets completely, because attackers still prioritise likely human output first, but it does decide how quickly the cheapest part of the cracking queue gets burned through.
That queue is the real story. Modern cracking is ranked, not neutral. Old breach corpora, names, years, teams, keyboard patterns, substitutions, and phrase fragments all sit inside the attacker's first moves. A password can feel personal and still be painfully familiar to a model trained on millions of other users trying to be personal in the same ways. This is why the standard phrase brute force often hides more than it explains.
Why replay still matters more than people want to admit
If a credential already exists in a leaked set, there may be no reason to crack anything new. That is the enduring value of credential stuffing. The 2025 reporting on massive credential compilations only restated that reality at scale.[1] Not every record has to be fresh, and not every dataset has to be clean. Enough overlap is enough. A technically strong password reused across services is still a weak operational asset because the attacker does not care that it would have been hard to discover from scratch.
Then the problem shifts again. Phishing, infostealers, malicious extensions, and session theft turn password abuse into a collection problem rather than a guessing problem. The attacker stops approximating the secret and starts collecting valid access. Good password practice still matters, but it answers fewer questions than people want it to answer. That is why serious defenders should ask one thing before all the others: which attacker shortcut is still cheap. The answer usually explains the control priority more clearly than any abstract debate about password complexity ever will.
Selected references
Keep exploring PhraseForge
Return to the generator or continue through the article library.