Password hashing and cracking (your own hashes only)

Why hashes exist

A hash is a one-way fingerprint of some data: the same input always gives the same hash, but you cannot reverse the hash back into the input. Systems store the hash of your password, not the password itself, so that a database leak does not immediately reveal everyone's password.

What "cracking" really is

Because hashing is one-way, an attacker who steals hashes cannot reverse them. Instead they guess: take a candidate password, hash it, and see if it matches the stolen hash. Tools like hashcat and John the Ripper automate this at huge speed, trying dictionary words and variations. This is "cracking". It is only practised, legally and safely, on hashes you generated yourself for learning.

Why slow, salted hashing wins

• Fast hashes (like plain SHA-256) are made for speed, so attackers can try billions of guesses per second. They are wrong for storing passwords.
• Slow hashes (bcrypt, scrypt, Argon2) are deliberately expensive, so each guess is slow and cracking becomes impractical.
• A salt is random data added to each password before hashing, so identical passwords get different hashes and precomputed tables (rainbow tables) do not work.
• The best defence of all is strong, unique passwords (or passphrases) plus MFA, so even a cracked hash has limited value.

Detection and defence

Cracking happens offline on stolen hashes, so it cannot be detected directly. The defences are preventive: store passwords with a slow, salted algorithm; enforce strong passwords and check them against known-breached lists; add MFA; and protect the password database so it is never stolen in the first place. Detection focuses on the theft (unusual database access) and on login abuse, not on the offline cracking itself.