Passwords fail in predictable ways. Understanding the attack tells you which defence actually helps.
How password storage should work
A password is never stored in plain text. The server stores a hash: a one-way fingerprint. When you log in, it hashes your attempt and compares.
A salt is a unique random value added before hashing. It ensures two users with the same password get different hashes and defeats precomputed tables.
Password hashes should be slow: bcrypt, scrypt or Argon2. A fast hash such as SHA-256 is designed for throughput, which also helps the attacker.
The main attack types
| Attack | What it does | Best defences |
|---|---|---|
| Brute force | Tries many passwords for one account | Long passwords, lockout/rate limits, MFA |
| Spraying | Tries a few common passwords across many accounts | MFA, breached-password checks, smart lockout |
| Credential stuffing | Replays passwords from other breaches | Unique passwords, MFA, breach detection |
| Offline cracking | Attacks a stolen hash database at speed | Slow salted hashes, long passwords |
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.