By: Alex McOmiePassword manager reviewer
Editor: Owen DubielIT security and VPN expert
When you think about how hackers steal passwords, you might imagine them using bots to enter thousands of characters until they hit the right combination. While this technique still exists, it’s relatively inefficient and difficult to execute since most websites place limits on consecutive login attempts.
The more complex your password is, the less likely it is to be guessed randomly. As long as you use a strong password, it’s extremely difficult for anyone to access your accounts by guessing.
According to NordPass, the five most common passwords are
The main reason that guessing is still a viable tactic is that so many people continue to use predictable passwords. If you’re having trouble remembering complex passwords, use a password manager that can generate and store strong passwords.
Websites and applications store hashed and encrypted bits of your password in order to properly authenticate your account when logging in. If a platform you use is hit by a data breach, your password could be available on the dark web.
As a general user, it may seem like there is nothing you can do to prevent a data breach. However, some cybersecurity providers now offer monitoring services that notify you when any of your passwords are compromised.
Even if you aren’t aware of any data breaches, it is highly recommended that passwords are changed every 90 days to better prevent stale passwords from being captured and used.
In general, websites and applications store your passwords in either hashed or encrypted form. Hashing is a kind of encoding that only works in one direction. You enter your password, the password is hashed, and then that hash is compared to the hash associated with your account.
Even though hashing only works in one direction, hashes themselves contain signs or clues about the passwords that produced them. Rainbow tables are datasets that help hackers identify potential passwords based on the corresponding hash.
The main impact of rainbow tables is that they enable hackers to crack hashed passwords in a fraction of the time that it would take without them. While a complex password is more difficult to crack, it’s still only a matter of time for a skilled hacker.
Persistent dark web monitoring is the best way to get in front of a data breach so that you can change your password before it’s cracked. You can get dark web monitoring from most of the top password managers in 2023.
Even if your password is resistant to totally random guesses, it may not offer as much protection against spidering. Spidering is the process of gathering information and making an “educated” guess.
Spidering is usually associated with companies rather than personal accounts. Corporations tend to use passwords that relate to their brand, which makes them easier to guess. A hacker could use a combination of publicly available information and internal documents, such as employee handbooks, with details about their security practices.
Even though spidering attempts against individual users are less common, it’s still a good idea to avoid passwords that are related to your personal life. Birthdays, kids’ names, and pets’ names commonly are used and could be guessed by anyone who has that information.
Phishing is when hackers pose as legitimate websites to trick people into sending their login credentials. Internet users get better at recognizing phishing attempts over time, but hackers are also developing more sophisticated techniques to continue cracking passwords.
Like data breaches, phishing works just as well against strong passwords as it does against weak ones. On top of creating strong passwords, you also need to follow some other best practices to block phishing attempts.
First, make sure you understand the telltale signs of phishing. For example, hackers often send extremely urgent emails in an attempt to get the recipient to panic. Some hackers even pose as friends, coworkers, or acquaintances to gain the target’s trust.
Second, don’t fall for the most common phishing traps. A reputable website never asks you to send a password, authentication code, or any other sensitive information through email or short message service (SMS). If you do need to check your account, enter the URL manually in your browser instead of clicking on any links.
Finally, turn on two-factor authentication (2FA) on as many of your accounts as possible. With 2FA, a phishing attempt won’t be enough — the hacker still needs an authentication code to access your account.
Malware refers to many different kinds of software that are created and distributed to harm the end-user. Hackers use keyloggers, screen scrapers, and other types of malware to pull passwords directly from the user’s device.
Naturally, your device is more resistant to malware if you install antivirus software. Anti-virus is a reliable platform identifies malware on your computer, warns you about suspicious websites, and stops you from downloading harmful email attachments.
Having one of your accounts hacked is bad but having them all hacked at once is much worse. If you use the same password for multiple accounts, you’re increasing the risk attached to that password significantly.
Unfortunately, it’s still common for people to have a single password for every single account. Remember that strong passwords aren’t any better than weak passwords in the event of a data breach, and there’s no way to predict when a breach occurs.
With that in mind, it’s just as important for your passwords to be unique as it is for them to be resistant to hacking. Even if you’re having trouble remembering your passwords, you should never reuse the same ones. A secure password manager can help you keep track of your passwords across different devices.
In 2023, hackers use many different strategies to break into accounts. Earlier password hacking attempts were generally more rudimentary, but hackers have stepped up their tactics in response to a more technically literate public.
Some websites have basic password strength requirements such as at least eight characters, at least one number, and at least one special character. While these requirements are better than nothing, the truth is that you need to be even more careful to avoid the most popular password cracking techniques.
To optimize your cybersecurity, you need to enable two-factor authentication wherever possible and use strong, unique passwords for each of your accounts. A password manager is the best way to create, store, and share passwords. Furthermore, many password managers come with built-in authenticators. Check out our list of the best password managers of 2023 to learn more about the top providers.