Credential cracking is software guessing passwords for one or more known usernames, using dictionaries, leaked password lists, and rule-based tweaks on common words. Because it targets accounts the attacker already knows exist, a hit is far more likely than blind guessing.
What is credential cracking, in plain English?
Credential cracking is targeted password guessing. The attacker already has a known username, an email or a login harvested from a list, and tries to find the matching password. Rather than random guesses, they use dictionaries of common passwords, leaked password lists from past breaches, and rule-based mutations that mimic how people build passwords: adding a year, capitalizing a letter, swapping an o for a zero.
The advantage over blind brute force is focus. Because the account is confirmed to exist and the guesses are drawn from how real people actually choose passwords, the hit rate is much higher per attempt. A "low-and-slow" variant spreads the attempts out over time to stay under lockout thresholds and avoid tripping alarms.
Credential cracking overlaps with brute force and credential stuffing but has its own emphasis: it aims at real, confirmed usernames and works the password side intelligently. It is a common on-ramp to account takeover, which is why breached-password screening and MFA matter so much here.
How credential cracking runs
- Collect — Gather known usernames. The attacker assembles a list of confirmed logins from breaches, scraping, or enumeration.
- Build — Prepare smart guesses. Dictionaries, leaked password lists, and mutation rules generate likely passwords for each account.
- Attempt — Test at a careful pace. Guesses are tried against the known usernames, often slowly to avoid lockouts and detection.
- Take over — Use the cracked login. A correct guess grants access, and the attacker moves to change details or extract value.
Cracking, stuffing, and brute force
Trait | Credential cracking | Stuffing and brute force |
Target | Known usernames, unknown passwords | Stuffing uses known pairs; brute force guesses everything |
Guess source | Dictionaries, leaks, mutation rules | Stuffing reuses breached pairs; brute force exhausts the space |
Hit rate | High per account, guesses are informed | Stuffing high; blind brute force low |
Stealth | Often low-and-slow to dodge lockouts | Brute force loud; stuffing high-volume |
What it looks like in practice
In practice
An attacker has a list of real customer email addresses from an unrelated breach. Instead of trying random passwords, they run each email against a dictionary of common passwords plus mutations: the same word with a number, a season, a capital letter.
The attempts are paced out, only a few per account per hour, so no single account trips its lockout and the traffic blends into normal login noise. For the customers who reused a weak or common password, the guesses land, and those accounts are taken over one by one. Breached-password screening at login would have blocked the reused passwords before they ever worked.
Why it matters to operators
Credential cracking is more efficient than it looks because it exploits real human password habits. Confirmed usernames plus informed guessing means a meaningful share of accounts with weak or reused passwords will fall, and the low-and-slow pacing is designed to slip past per-account lockouts and simple rate limits.
Defenses layer several controls: breached-password screening so known-compromised passwords cannot be used, anomaly detection on login patterns to catch distributed slow attempts, bot management, and MFA so a cracked password alone is not enough to get in. As with brute force, the tradeoff is tuning lockouts and challenges tightly enough to stop attackers without blocking genuine customers.
What to watch for
- Dictionary patterns. Login attempts that walk through common passwords and predictable mutations rather than random strings.
- Low-and-slow. A few attempts per account spread over time, sitting just under lockout thresholds.
- Distributed sources. Guesses arriving across many IPs or a proxy pool to avoid per-source rate limits.
- Reused-password hits. Successful logins on accounts whose passwords appear in known breach lists.
- Takeover follow-through. A cracked login quickly followed by contact or payout changes.
Quick questions
How is credential cracking different from brute force?
Brute force blindly exhausts the keyspace. Cracking targets known usernames and uses smart guesses from dictionaries, leaks, and mutation rules, so it is more efficient and often quieter.
How is it different from credential stuffing?
Stuffing replays exact username and password pairs stolen from breaches. Cracking knows the username but must guess the password, using informed lists and rules rather than a known pair.
Why is the low-and-slow version dangerous?
By spreading a few attempts per account over time, it stays under lockout thresholds and blends into normal login traffic, so per-account monitoring alone often misses it.
What stops it most effectively?
Breached-password screening plus MFA. If compromised passwords cannot be used and a password alone is not enough to log in, cracked guesses stop translating into takeovers.
Why do mutation rules work so well?
People build passwords in predictable ways, adding years, seasons, or simple character swaps. Rules that mimic those habits generate exactly the passwords many users actually pick.
What is the tradeoff to manage?
Aggressive lockouts and challenges block attackers but can also frustrate or lock out real users. Thresholds and step-ups need tuning to catch cracking without harming legitimate logins.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.