Explained Live · lesson 1 · 2026-09-05 · updated 2026-10-12

Password Cracking Explained — See It Happen Live

▶

Before you start

• A Kali Linux machine or VM (Hashcat is preinstalled).
• The rockyou.txt wordlist at /tmp/rockyou.txt. On Kali: sudo gunzip -k /usr/share/wordlists/rockyou.txt.gz && cp /usr/share/wordlists/rockyou.txt /tmp/.
• A working folder: mkdir -p /tmp/hashcat-demo && cd /tmp/hashcat-demo.
• Only crack hashes you created yourself or are authorized to test.

Every password stored in a database is hashed — turned into a string of characters that looks like random noise. The idea is that it cannot be reversed. In this video we crack a real hash live, from scratch, using Hashcat and a wordlist, and we show exactly what defenders need to do to stop it. Let’s get into it.

First, let’s understand what a hash actually is.

What is a password hash?

• A hash function takes any input and produces a fixed-length output
• Same input always produces the same output — but you can’t reverse it
• Websites store the hash, not the password — even they can’t read it back
• When you log in, the site hashes what you typed and compares the two hashes

When you create an account on a website, the site takes your password, runs it through a hashing algorithm, and stores the result. The original password is thrown away. When you log in, it hashes whatever you typed and compares that hash to the one on file. If they match, you are in. The site never stores your actual password. The consequence of this design is that if someone steals the database, all they have is a list of hashes — not readable passwords. Or so the idea goes.

Let’s make a hash right now and see what one looks like.

Step 1 — create an MD5 hash

echo -n "password123" | md5sum

That 32-character string is the MD5 hash of the word password123. Every single time you run that exact command, you get the exact same output. But go in the other direction — start with the hash and try to get back to password123 — and MD5 gives you nothing. The hash is a one-way door. That is what makes it useful for storing passwords. The problem is not the algorithm. The problem is weak input.

Here is what hash cracking actually is.

What is hash cracking?

• You cannot reverse a hash — but you can guess the input
• A wordlist contains millions of real passwords from past data breaches
• Hash each word in the list, compare to the target — if it matches, you win
• Hashcat automates this at millions of guesses per second

You cannot reverse a hash, but you can guess. A tool like Hashcat takes a wordlist — a file containing millions of real passwords collected from actual data breaches over the years — hashes every single word, and compares each result to the hash you are trying to crack. The moment a hash matches your target, the original password is right there. On a modern CPU this happens at millions of guesses per second. On a GPU it is billions. Common passwords fall in under a second.

Here is the Hashcat command we are about to run.

The Hashcat command

hashcat -m 0 hashes.txt /tmp/rockyou.txt -D 1 --quiet --potfile-disable

The minus m zero flag tells Hashcat the hash type. MD5 is mode zero. If you were cracking SHA-256 hashes you would use minus m 1400. Hashcat supports over 350 different hash algorithms. The wordlist is rockyou dot txt — a file compiled from real leaked passwords, over 14 million of them, released after a breach years ago. It is the standard starting point for any cracking job because weak passwords appear in it constantly. Minus D one tells Hashcat to use the CPU — on this machine there is no compatible GPU for cracking.

Now let’s give it something to crack. I am saving two hashes to a file — we will pretend these came from a database we are testing.

printf '482c811da5d5b4bc6d497ffa98491e38\n0d107d09f5bbe40cade3de5c71e9e9b7\n' > hashes.txt && cat hashes.txt

Two MD5 hashes. We do not know what the original passwords are — that is the point. We hand this file to Hashcat and let it work.

hashcat -m 0 hashes.txt /tmp/rockyou.txt -D 1 --quiet --potfile-disable

Hash colon password123. Hash colon letmein. Both cracked. The format is always the same — the hash on the left, the recovered plaintext password on the right. Hashcat found both because password123 and letmein are among the most common passwords in the entire rockyou list. They appear near the top, so the match happens in the first fraction of a second. An attacker running this against a real database dump would recover every weak password in the file before they had time to make coffee.

This is why weak passwords are a real threat.

What this means in practice

• Any password in a wordlist cracks instantly — no matter how long the hash is
• Breached databases are sold and traded — the cracking happens offline
• Once cracked, attackers try the password on every service the person uses
• Password reuse turns one cracked hash into access to email, bank, everything

The cracking happens entirely offline. An attacker downloads a stolen database, takes it home, and runs Hashcat against it on their own hardware, completely invisible to the victim. Once they recover a password, they try it on every service that person uses — email, banking, work accounts. Because most people reuse passwords, one cracked hash opens multiple doors. The hash itself is not the weakness. The weakness is the password that went into it.

Here is what actually stops this.

How to stop hash cracking

• Use bcrypt, Argon2, or scrypt — not MD5 or SHA — they are slow by design
• Add a salt: a random string mixed into each password before hashing
• A salted hash makes wordlists useless — the same password hashes differently each time
• As a user: use a password manager — every site gets a unique random password

The first fix is the hashing algorithm itself. MD5 and SHA are fast — designed for checking file integrity, not storing passwords. Fast means Hashcat can try billions per second. Bcrypt, Argon2, and scrypt are deliberately slow — they are designed to make cracking expensive. A hash that takes one tenth of a second to compute takes over three years to crack one billion guesses against. The second fix is salting: adding a unique random string to each password before hashing. Even if two users have the same password, their hashes are different, and no pre-built wordlist applies. As a user, your defense is simple — use a password manager and give every site a unique random password. If it is not in the wordlist, it does not crack.

One rule before you go.

Before you go

• Only crack hashes you own or have written permission to test
• Running Hashcat against hashes from a system you don’t own is illegal
• Practice on hashes you create yourself — like we did here
• OWASP A02:2021 Cryptographic Failures covers weak hashing in real apps

Only ever crack hashes that belong to you or that you have explicit written permission to test. Running Hashcat against a stolen database is illegal — even if you are just curious about whether it works. Everything we did in this video used hashes we created ourselves on a local machine. O-WASP tracks weak hashing under A-02:2021 Cryptographic Failures — if you want to go deeper on how this shows up in real applications, that is the right starting point. Thanks for watching, and I will see you in the next one.