Brute force can be used to crack passwords by trying a large number of passwords. Why does no one try the brute force approach on every single character of the password instead?

  • 8
    You need to look at how password hashing works - for most modern storage methods, you can't check a part of the password as a separate step. It's either the whole password correct, or you don't know how wrong you are. – Matthew Feb 17 '17 at 13:55
  • 3
    You can't brute force parts of a password because you only get a confirmation whether the entire password is correct -- not for a selected part or a single character. – Arminius Feb 17 '17 at 13:56
  • I edited the title to make it clearer. I hope my edits were in line with what you wanted to ask? – Anders Feb 17 '17 at 14:29
  • 3
    You can only crack passwords a character at a time in movies or tv shows. – TTT Feb 17 '17 at 17:06
  • 1
    @matthew could you elaborate? – Awn Feb 17 '17 at 17:16

Because most operating systems hash passwords once entered (and store them in a database). This means that the entire password is converted into a collection of cryptographic hashes, random-looking strings of characters into which the passwords have been mathematically transformed to prevent them from being misused.

So, once a password is hashed for a well defined hash, there is no way to attack each character. That is circular logic. To attack each character you must know each character. To know each character you must attack each character.

| improve this answer | |
  • 2
    And one of the attributes of a good cryptographic hash function is that a small change results in a very different hash, so you can't tell if you're close. – Xiong Chiamiov Feb 17 '17 at 15:18
  • I think you should add "for a well designed hash" to the last statement. The Lanman hash, for instance could attack sub-sections of the password at one time, which significantly weakened the hash. Not character by character, but the concept is the same. – Steve Sether Feb 17 '17 at 20:41
  • Your point is noted, and I agree. Thanks for the suggestion. – user34445 Feb 17 '17 at 22:11

If by cracking you mean breaking a given hash of password(s) then it isn't possible since hash functions are built to have seemingly random outputs, so for example: The SHA-1 hash of 'Password' is:

SHA-1(Password) = 8be3c943b1609fffbfc51aad666d0a04adf83c9d

but change only the first character ('Sassword') and you get:

SHA-1(Sassword) = 1243263916a8d81369235831d5a224bbae87a86a

As others have mentioned, hash functions are made to appear this way just for this purpose; to thwart attempts to 'crack' them.

If by cracking you mean brute forcing a user's login credientials to a site, then it is even more clear why it wouldn't work - you won't get feedback from the site saying "The first letter was correct, but the rest wasn't", etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.