Password Cracking

About Password Cracking

Password cracking tools test the strength of password hashes and online authentication systems. The category divides into offline hash crackers and online authentication testers. Offline crackers like hashcat and John the Ripper process password hashes recovered from systems or databases, using dictionary attacks, rule-based mutations, and brute-force modes to recover plaintext passwords. GPU-accelerated modes in hashcat can test billions of hash candidates per second on modern hardware. Online testers like Hydra and Medusa test remote authentication services by attempting logins against SSH, HTTP, RDP, and other protocols, measuring whether services enforce rate limiting and account lockout. Wordlist generators like CeWL build target-specific candidate lists by spidering an organization's website and extracting terminology that employees might use in passwords. Defensively, these tools validate password policy effectiveness, identify weak or reused credentials before attackers find them, and test whether authentication services resist brute-force attacks. All tools in this category are for authorized testing only, used against systems and hashes the tester has permission to assess.