How passwords are stored, and cracked

Chuka hasn't used an old online shopping site for three years. He has almost forgotten he has an account there. Then one morning he can't get into his email. By the afternoon, his Instagram has been taken over and is posting adverts for fake investments. A week later, he learns why: the old shopping site had been broken into, and its list of customers' email addresses and passwords had been passed around among criminals. Chuka had used the same password there as everywhere else.

Nobody "hacked" Chuka's email in the way films show it. Nobody needed to. Someone simply tried his email address and his old password on his email account — and it worked.

In this lesson you will see how websites are supposed to store your password so that even a break-in doesn't reveal it, how criminals still crack weak passwords, and why the one habit that matters most is never using the same password twice. You will also see a promise kept from Lesson 3.2: how a bank can check your PIN without ever storing it in a form someone could read.

Words in this lesson

A website should never know your password

Here is a surprising truth: a well-built website does not keep your password at all.

Instead, it keeps a hash of it. A hash is the result of a special calculation that takes any input — your password, a document, a whole film — and produces a fixed-length string of scrambled-looking numbers. The calculation is one-way: easy to do forwards, practically impossible to run backwards. From the hash, there is no practical way to work out the password.

So how does the site know you typed the right password when you log in? It doesn't need to know the password. It hashes whatever you just typed and compares that hash with the one it stored. Same password, same hash: you're in. Wrong password, different hash: you're not.

This is the promise from Lesson 3.2. A bank stores a scrambled version of your PIN, and checking it still comes down to comparing bits — exactly the "are these the same?" circuit you built from gates, now comparing two hashes instead of two raw numbers.

The US National Institute of Standards and Technology (NIST), whose password guidance is followed widely, says that services must store passwords in a form that resists attack, using a salted hash — the next idea.

See a hash yourself

You can make a hash on your own computer. Windows includes a tool for it; Microsoft describes certutil -hashfile as generating and displaying a cryptographic hash over a file.

1. Open Notepad, type inova2026, and save it as test.txt in your Documents folder.
2. Open Command Prompt, go to that folder (type cd Documents), and type:

certutil -hashfile test.txt SHA256

You will see a long string of hexadecimal digits — the file's hash. Now change one letter: make it Inova2026, with a capital I. Save it and run the command again. The hash will be completely different — not slightly different, completely.

For example, the hash of the text inova2026 (with nothing else in the file) begins 9d0e8479…, and the hash of Inova2026 begins c24f54f2…. (If your file has anything extra, even a new line at the end, your hash will be different from these — which proves the point: any change at all changes everything.)

That is what makes hashes so useful. Two identical inputs always give the same hash, so comparing works; but the hash gives away nothing about the input, and tiny changes scramble it beyond recognition.

Salt: why two people with the same password look different

There is a weakness. If two customers both use the password password123, their hashes would be identical — and criminals keep huge lists of the hashes of common passwords, ready to look up.

The answer is salt: a random value, different for every account, mixed with the password before hashing. NIST requires the salt to be at least 32 bits and stored alongside the hash. Now two people with the same password have completely different hashes, and pre-made lists are useless — every account has to be attacked separately.

NIST also asks services to make the hashing deliberately slow, using a "cost factor" set as high as practical. A fraction of a second is nothing to you when you log in once; it is a huge obstacle to someone trying billions of guesses.

How criminals crack passwords

When a site is breached, criminals may get its list of email addresses and password hashes. They can't reverse the hashes. So they guess: they take a likely password, hash it the same way, and see whether it matches. Their computers can make enormous numbers of guesses — and this is where the length of your password decides everything.

Suppose, just for this example, a criminal could test a billion guesses every second. Using the doubling and multiplying from Module 2:

Each extra character multiplies the work by 26. Length beats cleverness.

But criminals don't start by trying everything. They start with what people actually choose: common passwords, words from the dictionary, names, birthdays, and passwords leaked from earlier breaches. That is why NIST tells services to reject passwords found in lists of previously breached passwords and dictionary words. And it is why the UK's National Cyber Security Centre (NCSC) warns that swapping letters for lookalikes — a zero for an "o", say — doesn't help much: criminals know those tricks too.

The real danger: using a password twice

Now back to Chuka. His old shopping site's password list was cracked — not because of anything he did there, but because his password was common enough to guess. Criminals then did something simple and devastating: they took his email address and password and tried them on other sites. This is credential stuffing, and it works because so many people reuse passwords.

The NCSC's advice is direct: use a unique password for every account, so that if one is discovered, a criminal only gets into one account. It singles out your email account for an especially strong, separate password — because your email can be used to reset the passwords of almost everything else.

You can check whether your email address has appeared in a known breach on Have I Been Pwned, a free service created by security researcher Troy Hunt to let anyone quickly see whether they may have been put at risk. If your address appears, change the password for that site — and for any other site where you used the same one.

What makes a strong password today

Put the official advice together:

• Length. NIST now requires a password used on its own to be at least 15 characters long, and says services should allow passwords of at least 64. CISA, the US cybersecurity agency, recommends at least 16.
• Randomness you can remember. The NCSC recommends three random words — something like the NCSC's own example, CupFishBiro — rather than a short jumble of symbols. Avoid anything personal: names, birthdays, your favourite team.
• No pointless rules. NIST tells services not to force mixtures of character types, and not to force you to change passwords on a schedule unless there is evidence one has been stolen.
• One password per account. Always.
• A password manager. CISA explains that a password manager creates and stores long, random, unique passwords for every site, so you only need to remember one strong password — the manager's own. The NCSC also notes that writing passwords down is acceptable if you keep them somewhere safe.

And one more layer, which matters so much it has its own lesson (9.3): turn on two-step verification, so that a stolen password alone is not enough.

Common mistakes

The short version

• Good websites store a salted hash of your password, not the password. They hash what you type and compare. NIST requires salted, deliberately slow hashing.
• A hash is one-way, and any tiny change in the input changes it completely — try certutil -hashfile to see.
• Criminals crack by guessing and comparing hashes. Length multiplies their work: 8 small letters in minutes, 15 in tens of thousands of years at the same rate.
• Credential stuffing uses passwords from one breach on other sites. Use a unique password for every account, especially email. Check Have I Been Pwned.
• Today's advice: at least 15 characters for a password used on its own (NIST), three random words (NCSC), no forced complexity or routine changes, and a password manager (CISA).

Try it yourself

Make your passwords uncrackable.

1. Make two text files, one containing inova2026 and one Inova2026, and hash each with certutil -hashfile … SHA256. Write down the first eight characters of each hash. What does this show you?
2. Work out how many possibilities a 4-digit PIN has, and a 12-letter password using only small letters. How many times bigger is the second?
3. Check your main email address on haveibeenpwned.com. Write down how many breaches it appears in (if any) and which sites.
4. Make a list of your ten most important accounts (no passwords!). Mark every account that shares a password with another. Change the most important ones first, starting with your email.
5. Create one new password using three random words. Explain to someone why it is stronger than their current one.

You'll know you've got it when you can explain how a website checks your password without knowing it, why Chuka lost his accounts, and why one long, unique password per account — kept in a password manager — protects you better than any number of clever symbols.