← All projects
IB Computer Science · Extended Essay

How strong is it, really?Cracking Passwords

Full paper Read the actual essay

Is “Password1!” a strong password? A GPU and I found out.

My research question: how do password length and character complexity affect resistance to brute-force and dictionary attacks? To answer it, I cracked 70 MD5-hashed passwords with hashcat, from random strings to ones built around a made-up person's life.

Subject
Computer Science
Length
~4,000 words
Tool
hashcat
Passwords
70
Create your account
Password1!
  • At least 8 characters
  • An uppercase letter
  • A number
  • A symbol
Strong password
01

The question

Every sign-up form gives the same advice: make it long, and mix in an uppercase letter, a number, and a symbol. “Password1!” does all of that. It's also exactly the kind of password people make to get past those rules, and it shows up more than 580,000 times in known data breaches. An attacker would get it almost instantly.

That gap, between a password that follows the rules and one that's actually hard to guess, is what this essay is about. And passwords aren't going anywhere: they're still the most common way we log in to things.

The catch is that “strong” depends on who's attacking. There are two main ways to crack a password, and they care about completely different things.

Brute force

Tries everything

Every possible combination of characters, one after another, until one works. The only thing that slows it down is how many combinations there are, so length and complexity are what matter.

Dictionary

Tries the likely stuff

A list of guesses: common words, leaked passwords, things like “123456”. Here a longer or more complex password isn't automatically stronger. Predictability is what matters.

My answer: length and complexity make brute force exponentially harder, but barely slow a dictionary attack down. Only a password that's long and genuinely unpredictable survives both.

02

How cracking works

Websites (the good ones) never store your password. They store its hash. So to crack a password, an attacker guesses one, hashes it, and checks whether it matches. Then does that again. And again. Billions of times a second.

Its MD5 hash
5f4dcc3b5aa765d61d8327deb882cf99

Nothing you type leaves this page. Change one letter and the whole hash changes. The other way doesn't work at all: there's no turning a hash back into the password. That's why attackers have to guess.

Why MD5

MD5 was made by Ronald Rivest in 1991, and it was built to be fast. A modern GPU can do over 200 billion MD5 hashes a second. That's great for checking a file, and terrible for passwords: the faster an attacker can hash, the faster they can guess.

Real systems use deliberately slow algorithms like bcrypt or Argon2. I used MD5 on purpose, because its speed spans the whole range, from instant to effectively impossible, all within something I could actually measure.

Keyspace

The keyspace is every password that could exist for a given length and set of characters: charsetlength. Brute force has to search it. On average it finds the password halfway through.

Adding a character multiplies the keyspace by the whole character set. Adding character types only gives each position a few more options. Below, starting from 2 lowercase: double the options for each spot, or add one more spot. Length wins.

6762 lowercase
2,7042 mixed case2× options per spot
17,5763 lowercasejust 1 more spot

Wordlists and rules

In 2009, the RockYou breach leaked over 32 million passwords in plain text. They became rockyou.txt, which is now the default list for generic dictionary attacks, because it's easy to get and full of real habits.

A targeted attack builds a small list about one person (name, pet, birthday) and runs it through mangling rules that turn words into password-shaped guesses: “password” → “Password1”, “p@ssword”. Free tools like CUPP will even build the list for you.

Try it: how long would my GPU take?

Pick a character set and a length. This uses the speed I actually measured, 5.5 billion guesses a second, and the average case: half the keyspace.

Keyspace949 = 5.73 × 1017
Average time to crack1.65 years
A random 9-character password using every character type.
03

The experiment

Two sets of passwords, one for each attack. A dictionary attack would crack almost none of a random set, and real human passwords can't show what length and complexity do on their own. So I split it.

PowerShell
# brute force, pinned to the main GPU
> hashcat -m 0 -a 3 -d 2 setA.txt ?a?a?a?a?a?a

# generic dictionary attack
> hashcat -m 0 -a 0 -d 2 setB.txt rockyou.txt

# targeted: 13 facts, expanded by rules
> hashcat -m 0 -a 0 -d 2 setB.txt benji.txt \
    -r OneRuleToRuleThemStill.rule
Tool
hashcat, one of the fastest password-recovery tools, so every measurement came from the same place
GPU
AMD Radeon RX 7900 XTX, pinned with -d 2 so the slow integrated graphics stayed out of it
Hash
MD5 (-m 0)
Modes
-a 3 brute force, -a 0 dictionary, plus a rule file
Randomness
Python's secrets, not random: random is built for simulations, and could place passwords in predictable parts of the keyspace
Set A · brute force

60 random passwords

A grid of 5 lengths (6 to 10 characters) by 4 character sets, with 3 passwords in each of the 20 cells. Three per cell, because a single password could land at the very start or end of the keyspace and skew the time.

Measured: crack time. Whether it cracks isn't a question; brute force always gets there eventually.

Set B · dictionary

10 realistic passwords

Seven of the most common real passwords, from NordPass's list, and three built from a fictional person's life.

  • 123456
  • 12345678
  • password
  • 111111
  • qwerty
  • iloveyou
  • abc123
  • Steelers24
  • Loki2002!
  • Benji0424Pgh

Measured: cracked or not.

Fictional
Benjamin “Benji” WinterTarget profile
Nicknames
Benji, Ben
Birthday
April 24, 2002
Pet
Loki
Hometown
Pittsburgh (pgh)
Lives in
New York (nyc)
Team
Steelers

Every detail is made up. It's the kind of thing a real person's social media gives away.

Meet Benji

To test a targeted attack, I invented a person. From his “public” details I built three passwords, the way people actually make them:

  • Steelers24team + birth date
  • Loki2002!pet + birth year + symbol
  • Benji0424Pghnickname + birthday + hometown

Then I played the attacker. The base wordlist was just 13 raw facts, with nothing pre-mangled:

  • benji
  • benjamin
  • ben
  • winter
  • loki
  • pittsburgh
  • pgh
  • newyork
  • nyc
  • steelers
  • 2002
  • 24
  • 0424

hashcat expanded them with OneRuleToRuleThemStill, a free, public rule file built from testing against real breached passwords. Nothing an actual attacker couldn't get.

70.6 5.5 GH/s

The benchmark lied

hashcat's own benchmark said my GPU did 70.6 billion hashes a second. In every real run, from tiny keyspaces to huge ones, it held a steady 5.5. Not a warm-up thing either: it stayed there on runs over 10 minutes long. So I used 5.5 for every calculation, which made the real times about 13 times longer than the benchmark predicted.

43 s612 s

Luck of the keyspace

Two alphanumeric 7-character passwords: one sat 6.7% of the way into the keyspace and cracked in 43 seconds, the other sat 94.8% in and took 612. That's why every cell had three passwords, averaged.

264

Too big to even try

9 cells were small enough to crack for real. The other 11 would have taken up to years, so I calculated them from their keyspace. The biggest, 9410 = 5.4 × 1019, overflowed hashcat's 64-bit counter and threw an error before it started.

I double-checked hashcat's clock with PowerShell's Measure-Command: after taking off a 3.4-second startup, the two agreed within 0.2 seconds.

04

Results

From 0.044 seconds to 155 years. Same GPU, same tool. The only differences were 4 more characters and 68 more possible symbols.

Length Lowercase26 Mixed case52 Alphanumeric62 Full94 6 7 8 9 10
Measured (average of 3) Calculated from keyspace
Lowercase · 6 characters
0.044 s

266 ≈ 309 million combinations. Measured: the average of three real cracks.

Pick any cell. Every step right or down multiplies the time, and the two stack: 6 lowercase to 7 mixed case is a 1,316× jump; 8 alphanumeric to 9 full is 2,625×.

Set B: generic vs targeted

The same 10 hashes, two dictionary attacks.

PasswordTypeGenericrockyou.txtTargeted13 facts + rules
123456CommonCrackedCracked
12345678CommonCrackedCracked
passwordCommonCrackedCracked
111111CommonCrackedCracked
qwertyCommonCrackedCracked
iloveyouCommonCrackedCracked
abc123CommonCrackedMissed
Steelers24PersonaMissedCracked
Loki2002!PersonaMissedCracked
Benji0424PghPersonaMissedMissed
Total7 / 108 / 10

The 14-million-entry list missed every persona password. Thirteen facts about one person found two of them.

05

What it means

The most surprising result

Loki2002!

  • 9 characters
  • Uppercase
  • Numbers
  • Symbol

Any strength meter would call it strong. It meets every rule “Password1!” does. It survived the huge generic list, and then fell in seconds to a list of 13 facts.

  1. lokia fact: his dog's name
  2. Lokirule: capitalize
  3. Loki2002rule: append another fact, his birth year
  4. Loki2002!rule: add a symbol
  5. Crackedmatches the hash

It wasn't luck. The rule file was built from real breached passwords, which means it's built from human habits. Word, then personal number, then symbol: that shape is so common it's literally written into the rules. This is called pseudo-complexity: a password that looks complex, and so passes as strong, but is still weak to a small targeted list.

Computer science has a way to measure this: entropy, the number of guesses an attacker needs, in bits (each bit doubles it). A random 9-character password using every character type has about 59 bits, from E = L × log2(C). “Loki2002!” has the same apparent entropy. But an attacker doesn't have to try everything, only the predictable things, so its effective entropy is far lower.

Random 9 characters
~59 bits1.65 years to brute-force
“Loki2002!” looks like
~59 bitsapparent
“Loki2002!” really is
far lesscracked in seconds

Same length, same character types. Random structure is the difference between seconds and more than a year. “Steelers24” is the same story: a random 10-character alphanumeric password would take 2.42 years.

Brute force

exploits small keyspaces

beaten by a large keyspace

Generic dictionary

exploits common passwords

beaten by a unique one

Targeted dictionary

exploits your public info

beaten by a password it can't be built from

A password that's strong against one attacker can be weak against another. Only a long, random password has no structure for any of them to grab.

Limitations
  • Scope. Benji's passwords were built from personal info, so the dictionary results speak to that kind of password, not every password.
  • MD5. It's outdated. Real systems use slow hashes like bcrypt or Argon2, which would make every crack time far longer.
  • One GPU. A real attacker would use a cluster, so my times are on the long side.
  • None of that changes the relationship between length, complexity, predictability, and crack time.
06

So what should you do?

Here's the real problem: people can't remember unpredictable passwords. What makes a password strong is exactly what our memory is bad at, so we reach for something memorable, which means something predictable. The fix is to stop relying on memory.

Use a password manager. Let it make something like:
Bym3%83F3>@.Eeri
Made in your browser with crypto.getRandomValues, the same idea as Python's secrets.
16random characters, all 94 types
1.07 × 1014years to brute-force on my setup
7,700×the age of the universe

Don't look at “Password1!” and think it's strong. Use a password manager, and rest easy.

Sources (26)
  1. National Institute of Standards and Technology, “Strength of passwords,” NIST SP 800-63B. pages.nist.gov
  2. N. Woods and M. Siponen, “Too many passwords? How understanding our memory can increase password memorability,” International Journal of Human-Computer Studies, vol. 111, pp. 36–48, 2018. doi
  3. Have I Been Pwned, “Pwned passwords.” haveibeenpwned.com
  4. Cloudflare, “What is a brute force attack?” cloudflare.com
  5. Kaspersky, “What is a dictionary attack?” kaspersky.com
  6. C. Stryker, “What is AI scraping?,” IBM. ibm.com
  7. Y. Du et al., “Beyond data privacy: new privacy risks for large language models,” arXiv:2509.14278, 2025. arxiv.org
  8. OWASP, “Password storage cheat sheet.” owasp.org
  9. D. Wagner et al., “Cryptographic hashes,” Computer Security, UC Berkeley. textbook.cs161.org
  10. R. Rivest, “The MD5 message-digest algorithm,” IETF RFC 1321, Apr. 1992. ietf.org
  11. A. Antonov, “Cracked in under a minute: (nearly) every other password,” Kaspersky Daily, 2026. kaspersky.com
  12. A. Bellore, “Defending against password cracking: understanding the math,” Auth0 Blog, 2021. auth0.com
  13. CodePath, “Search key space,” CodePath Cybersecurity Guides. codepath.org
  14. N. Massier-Dhillon, “What is a dictionary attack,” Avast, 2026. avast.com
  15. C. Lurey, “Understanding RockYou.txt: a tool for security and a weapon for hackers,” Keeper Security Blog, 2023. keepersecurity.com
  16. R. Hranický et al., “Beyond the dictionary attack: enhancing password cracking efficiency through machine learning-induced mangling rules,” Forensic Science International: Digital Investigation, vol. 52, 2025. doi
  17. M. A. Rehman et al., “When intelligence fails: an empirical study on why LLMs struggle with password cracking,” arXiv:2510.17884, 2025. arxiv.org
  18. Mebus, “CUPP – Common User Passwords Profiler,” GitHub. github.com
  19. hashcat, “hashcat – advanced password recovery.” hashcat.net
  20. hashcat, “hashcat wiki.” hashcat.net
  21. Python Software Foundation, “secrets — generate secure random numbers for managing secrets.” docs.python.org
  22. Microsoft, “Measure-Command,” Microsoft Learn. learn.microsoft.com
  23. NordPass, “Americans' most common password is ‘secret’,” Nord Security, 2024. nordsecurity.com
  24. Stealthsploit, “OneRuleToRuleThemStill,” GitHub. github.com
  25. “OneRuleToRuleThemStill: new and improved,” In.Security, 2023. in.security
  26. Y. Z. Lim, H. B. A. Rahman, and B. Sikdar, “False sense of security on protected Wi-Fi networks,” arXiv:2501.13363, 2025. arxiv.org

The short version

Length and complexity make a password exponentially harder to brute-force. They do almost nothing if the password is predictable.

This page is the fun version. The full essay has every method detail, table, and citation.

What actually makes a password strong is unpredictability. Predictability is vulnerability.

Read the full essay ← Back to all projects