Why password hashes break

A wall full of archive drawers with one drawer open, containing two matching cards.

You read it all the time: "database of website X stolen, millions of passwords leaked". But a good site doesn't store your password — only its hash. And you can't calculate a password back from a hash, you know that since the last chapter. So… is there even a problem? Yes. And in this chapter you play the hacker to see why.

Words you might need

Database: The big table where a website keeps all its users: name, email address, and (if it's done right) the hash of the password.
Lookup table (or "rainbow table"): A list someone made in advance: on the left, billions of commonly used passwords; on the right, their hash. Anyone who comes across a hash looks it up on the right and reads off the password on the left. No calculating, just looking up.
Salt: Literally "salt": a random bit of text the website glues onto your password before it hashes it. A different one for every user. It's not secret — it's just stored next to the hash — but it makes every lookup table worthless.
PBKDF2: A hash function that's deliberately slow: it repeats the calculation hundreds of thousands of times. For you, that's half a second when logging in. For a hacker trying to guess billions of passwords, it's a wall.

How an "uncrackable" hash gets cracked anyway

The hacker doesn't calculate backwards. He calculates forwards. He takes a list of the billion most-used passwords — 123456, qwerty, welcome, the names of every football club — and calculates the hash of each one. That takes a while, but he only has to do it once. After that, he compares the stolen hashes against his list. Every hash that matches is a cracked password. No math, just patience and a big hard drive.

Play the hacker

Everything happens in your browser. Nothing is sent to the server. Even so, never type a password you actually use here — that's just a good habit.

Click Hash and look up. The demo hashes your password and looks up the hash in a little table of a few dozen commonly used passwords. Found it? Then you're "cracked".
Try qwerty, football, doctor. Then try something you make up yourself.
Click Same password, with salt. Same password, hashed twice — and yet two completely different hashes. Look them up: nothing.
Click With PBKDF2 (slow) and watch the time. Work out what that means for someone who has to try ten million times.

Password

Salt: everyone gets their own problem

Without salt, every user with the password welcome has the exact same hash. The hacker cracks one, and he's got them all. With salt, every user gets a different hash for the same password. The hacker now has to re-hash his entire list separately for every single user. A leak of ten million accounts becomes ten million separate jobs.

Slowness: the one weapon that really counts

SHA-256 is blazing fast — a decent graphics card manages billions of hashes per second. That's handy for files and disastrous for passwords. That's why good sites use a function that's deliberately slow. Click PBKDF2 in the demo and watch the time. A few hundred milliseconds is barely noticeable to you when logging in. But for the hacker, every attempt gets multiplied by that number — and he has billions of attempts to make.

What this means for you

Length beats weirdness. blue-bike-rain-tuesday is much stronger than P@ss1!, because it's on no list at all.
Never reuse a password across two sites. If the weakest site leaks, hackers immediately try that password on your email and your games.
A password manager remembers it for you. Then every password can be thirty random characters — you only have to remember one.

For when you build a website yourself one day: never write this yourself. Every programming language has a built-in function that handles salt and slowness properly (in PHP it's called password_hash()). Rolling your own thing with a hash and a salt is the classic beginner mistake — and behind half the leaks in the news.

This is math: how big is big?

An 8-lowercase-letter password has 26⁸ ≈ 200 billion possibilities. Sounds like a lot — a graphics card is through it in a minute. Four random words from a dictionary of 5000 words: 5000⁴ = 625 trillion, and that's without any capital letters or digits. That's the difference between exponentiation with a large base and a large exponent. Whoever has a feel for big numbers designs better locks than whoever doesn't.