Passwords are often the first line of defense against unauthorized access to user accounts, making secure password practices essential. The National Institute of Standards and Technology (NIST) emphasizes password length over complexity, recommending long passwords or passphrases that are difficult to guess. However, even strong passwords can be exposed if they are stored improperly. Rather than storing passwords in plaintext, organizations should use secure password hashing to protect them. This process transforms passwords into fixed-length values, making it significantly harder for attackers to recover the original passwords if a database is compromised.

 

The role of hashing algorithms in password protection

Hashing algorithms protect user passwords by converting them into fixed-length strings of characters called hashes. According to Microsoft Security, hashing “is designed to be a one-way process,” meaning that recovering the original input from its hash should be computationally infeasible. Since passwords are stored as hashed values rather than plaintext, organizations use them to verify credentials when users log in. However, not all hashing algorithms provide the same level of protection. Older algorithms, such as MD5 and SHA-1, are no longer considered suitable for secure password storage because of known weaknesses and their ability to process large numbers of guesses quickly. In her paper, Password Hashing as a Key Element of Security in Web Services, Izabela Markiewicz discusses how moving away from outdated methods towards modern password-hashing algorithms designed to resist brute-force attacks benefits organizational cybersecurity methods.

These attacks involve trying different passwords until the correct one is found. Algorithms such as bcrypt, scrypt, and Argon2 help protect passwords by making each attempt take more time and computing power. This makes it harder for attackers to crack stolen password hashes and recover the original passwords.

Another important safeguard is salting. This involves adding a unique, randomly generated value to each password before hashing it. Salting ensures that identical passwords produce different stored hashes, making it more difficult for attackers to use precomputed tables to identify passwords. Organisations can also implement peppering, which involves adding a secret value that is stored separately from the password database. If attackers obtain the database, the pepper provides an additional layer of protection, provided the secret remains secure.

These measures help reduce the risk of password exposure and limit the damage that can result from a compromised database.

See also: Differences between encryption and hashing

 

Can hackers crack hashing algorithms?

According to The Hacker News, “Because hashing algorithms are one-way functions, the only method to compromise hashed passwords is through brute force techniques. Cyber attackers employ special hardware like GPUs and cracking software (e.g., Hashcat, L0phtcrack, John The Ripper) to execute brute force attacks at scale—typically millions or billions or combinations at a time.” This means that while hashing is a strong security measure, not all hashing algorithms are equally secure. However, the difficulty of cracking a password depends on the hashing algorithm used and the complexity of the password itself.

Microsoft identifies several hashing algorithms used in cybersecurity, each with different strengths and uses:

  • MD5: MD5 is considered outdated because of known security weaknesses. It should not be used to protect passwords.
  • SHA-256: Part of the SHA-2 family, SHA-256 is widely used to check data integrity. However, it is not recommended on its own for password storage because it can calculate hashes quickly, allowing attackers to test many password guesses.
  • bcrypt: Unlike general-purpose hashing algorithms, bcrypt is designed specifically for password storage. It uses a unique salt for each password and lets you slow the hashing process, making it harder for attackers to crack stolen password hashes.

See also: HIPAA Compliant Email: The Definitive Guide

 

How cyberattackers crack hashed passwords

Cyber attackers use different techniques to guess passwords or recover them from stolen password hashes. According to The Hacker News, three common methods are brute-force attacks, dictionary attacks, and rainbow table attacks. Each uses a different approach to identify passwords and gain unauthorised access to accounts or systems.

 

Brute-force attacks

A brute-force attack involves using automated tools to try different password combinations until the correct one is found. These attacks can be more effective against short or easy-to-guess passwords. Attackers may use tools such as Hashcat or John the Ripper to speed up the process. Using long, unique passwords and enabling multifactor authentication (MFA) can help reduce the risk of these attacks.

 

Dictionary attacks

Dictionary attacks use lists of common passwords, words, and phrases to guess login credentials. These lists may include passwords exposed in previous data breaches or predictable combinations, such as a familiar word followed by a few numbers. This method is particularly effective against passwords that use common words or patterns. Using a long, unique password that is not based on easily guessed information makes these attacks less likely to succeed.

 

Rainbow table attacks

Rainbow table attacks use precomputed tables that link password hashes to possible original passwords. If attackers obtain a database of password hashes, they can compare those hashes against the tables to identify matching passwords. However, adding a unique, random salt to each password before hashing makes this technique much less effective because the same password produces different hashes when different salts are used. Using a secure password-hashing algorithm, such as bcrypt or scrypt, provides additional protection.

Related: Common password attacks and how to avoid them

 

How to strengthen your password security

The National Institute of Standards and Technology (NIST) recommends the following to strengthen your password security:

 

Use long, unique passwords

NIST recommends allowing long passwords and passphrases. As its guidance explains, “The use of passphrases (i.e., passwords with multiple words) is often an effective way to create a longer password.” Users should also avoid reusing passwords across accounts, as a breach of one service could expose others.

 

Block common and compromised passwords

Organisations should “be compared against a blocklist of unacceptable passwords,” and blocked. This makes it harder for attackers to guess credentials that are already known.

 

Store passwords securely

Passwords should never be stored in plaintext. Instead, organisations should use secure password-hashing algorithms with a unique salt for each password. This helps protect stored credentials if a database is compromised.

 

Limit login attempts and enable MFA

Limiting repeated failed login attempts can make automated password guessing more difficult. Organisations should also consider multi-factor authentication (MFA), which requires users to verify their identity using an additional method.

Go deeper: Password guidelines by NIST

 

FAQS

What is password hashing?

Password hashing is a security technique that converts passwords into fixed-length strings using cryptographic algorithms. This makes it difficult for attackers to retrieve the original password, even if they access the hashed version.

 

Why is hashing important for password security?

Hashing protects passwords from being stored in plaintext, reducing the risk of exposure in case of a data breach. Even if an attacker gains access to a hashed password, they must still crack it to obtain the original password.

 

What makes a strong password?

A strong password is long (at least 12-16 characters), includes a mix of uppercase and lowercase letters, numbers, and special characters, and avoids common words or patterns.

Related: 5 Steps to improve password security in healthcare