It's World Password Day! Rejoice, for today is the day that all of our friends will change their passwords from abc123 to 123abc!!! While we're on the topic of passwords, one thing websites do to encourage (well, force) a more secure password is to require that users create a password that typically includes at least:

  • one lowercase letter,
  • one uppercase letter,
  • one number and sometimes,
  • one symbol (!@#$%^&*)

But with so many websites that lock you out on the fifth attempt (sometimes third -_-), how are hackers able to figure out your password using the brute-force, iterative method (looping through a set of the most common passwords, then letter/number combinations, etc)? It seems like the requirements to make the password more complex are pointless becuase a hacker will rarely get more than five attempts before being locked out. So while people who have the typical password for their password will be easily hacked because it's the most commonly used password, having a password like fartbubbles is not likely to be discovered. Or is it?

As an insignificant addendum, I am not versed in digital security in the slightest so feel free to point out anything I say that is dumb and correct me on it. And laugh :]

4 Answers 4


To directly answer the question

how are hackers able to figure out your password using the brute-force, iterative method

Generally, breaking a password using 'mass-testing' is done offline. To do this, an attacker recovers a stored password (which is usually hashed) and tries to break the storage security. There is a number of methods that can used for this, depending on how the password is secured (Hash cracking, Rainbow table)

To put it more plainly, if an attacker has a method of testing a password offline, then the lockouts websites offer are ineffective.

An implication of this, as pointed out by Trey, is that if a password is re-used, then an attacker only needs to find the easiest recovery method, and then the attacker has access to any places that password was used. If a site stores a password in plaintext, and it's then recovered, anywhere that password is subsequently used can be considered compromised, regardless of security measures.


Yes attackers, and penetration testers, still use tools like Hydra to do bulk testing on passwords. That said this technique may not be cost effective against something like a banking site but very often users will use the exact same e-mail and password pair on another website with far less security like a personal blog, hobbyist forum, or a dating site. So those are the sites where more brute forcing will occur.

I will also point out something that may not be obvious. This doesn't represent how most passwords are lost to attackers. Sites can be attacked via a large number of methods and one very common one for the past few years has been SQL Injections. When an attack like this is available it can give an attacker or penetration tester access to the database which sometimes contains all of the passwords for a given website. A copy of the database my then be pulled by the attacker through this other hole. Likewise it's not uncommon for entire databases of these usernames and passwords to be posted by attackers to websites like pastebin.com where other attackers and penetration testers can grab them and use them.

This is something that I think the average person isn't really aware of and I wish it were more common knowledge to not use the same password on things like banking sites as one would on a site where security is less of a concern.

Similarly it's VERY important to protect the password for any e-mail accounts used for banking or other high-security sites. Especially if multi-factor authentication tokens are not being used. Access to an e-mail account can be used to do password resets on a large number of websites and quickly give an attacker access to a lot of digital assets & accounts. So where possible always enable multi-factor, or two-factor authentication, it really makes a huge difference.

  • What?! Sites are still getting penetrated with SQL injections? Lol how? Sanitizing inputs has been common knowledge as of, what, early 2000's? That's insane. Thank you for the answer! I really enjoyed reading it (and it inspired me to go read up on modern SQL counter-injection methods).
    – 8protons
    May 6, 2016 at 14:46

Many sites shut out a given IP address after 5 attempts...

If an attacker has a bot net have many hundred machines each try 5 attempts. That gives 500 guesses, enough to catch any really common passwords. This is not worthwhile for most accounts but admin and banking accounts it is tried.

A carefully configured web site will start requesting captchas or 2 factor authentication for logon attempts after the first five failed ones even on different IP addresses.


While it is easy to lock out a single account after a few incorrect login attempts, it is harder to guard against an attack against every account spread over many thousands of computers in a botnet, maybe using proxies to mask and/or change IP addresses, especially when the attack is intentionally slowed down to avoid raising suspicions.

While a single user can fairly easily force a single attacker to reach the lock-out threshold for their single account by choosing an uncommon password, an attacker who tries just the top five passwords on every account is likely to get access to a large portion of the accounts on the service.

So password policies such as those you mention are not to protect individual accounts. They are to protect the entire collection of accounts in aggregate, by attempting to force everyone to avoid the most common passwords. If nobody can use one of the top five passwords, then in theory the attackers have a much smaller chance of succeeding.

In reality, the attackers can probably predict the handful of modifications that a person will use to change "password" and "123456" into "P@ssword1" and "Abc123456!". So some number of accounts can probably still be compromised this way.

As others have pointed out, password re-use, phishing, offline attacks on a stolen password database, or a combination of these tend to be more successful attacks. But it's because of things like password policies and account lockouts that the conceptually easier method of just trying passwords is not as effective.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .