How to create strong, secure passwords by learning how to crack them

It gets harder to crack a password if it’s 10 characters or longer—but complexity matters too, of course.

- MARK HACHMAN

Create stronger, more secure passwords: We are nagged to do it all the time, but few of us actually make the effort to do so. Meanwhile, passwords continue to get stolen, leaked, and cracked on a regular basis. So this time we’re hoping to get your attention by looking at it from the attacker’s side of the equation. We’ll show you how passwords are cracked and even how to do it yourself, so you can see exactly why a strong password matters.

As our brief foray with a cracking tool will show you, your only protection against a determined password cracker is—you guessed it—a long, complex string of 10 or more characters. Anything shorter, let alone simpler, is too easy to crack. Know that, and suddenly using a password manager (go.pcworld.com/bpmn) looks a lot easier than trying to create passwords all by yourself.

Read on to learn more about how passwords are hidden from crackers, and how crackers try to tease them out.

Note: We tried cracking tools on our own passwords for this story. Using cracking tools to break into a website, service, or file that’s not yours is at best unethical—and at worst illegal. Take our advice and don’t even think about it.

HOW HASHING PROTECTS YOUR PASSWORD

To deter crackers, a responsible website won’t store a password in its original form, in what’s known as plain text. Instead, it will use a hashing algorithm—common ones include MD5, SHA2, or SHA3, but there are many more—to turn your password into a hash, a string of seemingly random numbers and letters.