We'll see how passwords are really cracked.

Passwords are not saved as plain texts by any website of this age on the internet.
They use a hashing algorithm to encrypt and manage passwords.

Types of Hashing Algorithm -


There are many types of hashing algorithms like the sha-1,md5,etc as an example for this.
Let's consider Facebook,
In order to log into your Facebook account,
You enter your email and password and click on log in.
The first time you create a Facebook account you are asked to fill in a form like this which contains your name your email address and it asks you to choose a  password your birth date and your gender.
Once you click on sign up this data is sent to the Facebook's back-end database.
In the Facebook's database your name,your gender,your age and your email or phone is saved as it is but what about the password.
As I told you a password will never be saved as a plain text in a website's database.
So this password is given as input to a hashing algorithm and the output given by this hashing algorithm is the encrypted form of the password which appears to be random but is not this hashed password is saved in the Facebook's database but not the plain text which means the password which you entered will never be saved on Facebook's database as a plain text.
Instead only it's encrypted or in other words the hashed password is saved in the Facebook's database.
Now suppose Facebook had a data breach and hackers managed to gain access to Facebook's user info which included their name,age,gender,email and password though hackers have this information.

They will not be able to log in to any specific user account because the password is encrypted.
If the hacker tries to log in to any specific user account with the hashed password he will not be provided access he only needs to enter the password which is in the plain text form.
So what do the hacker do know intuitively the only possible way is to reverse the hash into its plaintext form but this is highly impossible because a hash is a one-way function and the plaintext form of a hash cannot be obtained from the hash itself that is how hashing algorithms are designed.

What are Rainbow Tables ?


So what now this is when the strength of the password comes into the play if you are using a common password like test123456 which I used earlier to sign up for Facebook then the hacker will easily able to know the plaintext form of your password from the hash string there is something known as rainbow tables.
These rainbow tables contain the password hashes of numerous commonly used passwords along with their plaintext forms.

Types of Attacks used By Hackers -


So the hacker will be able to do a simple search with the password hash that he has and if the password hash exists in the rainbow table that means that the password is successfully cracked and we now have the password in a plaintext form remember the rainbow tables contain the password hashes of only the passwords which are commonly used as a reference.
You can try it yourself at crackstation.net but what if the password is not a commonly used password in that case rainbow tables are of no use so there comes dictionary attack and brute-force attack both are quite similar in picks area attack.

What is a Word list ?


You have a word list,
A word list is nothing but a huge text file with loads of passwords.
In this attack the hacker writes a code which compares the password has to be correct with the password hash of each and every password that exists in the world list file if any hashes match then it means that the cracking is successful and we now have the plain text of the hashed password.
Now this attack can be target specific as well which means you can actually create your own word list targeting a specific individual provided that you know some basic details about him and assuming that he used his basic details to frame his password this attack can be a success or a failure based on the quality of the word list that you are using.

How Brute-force attack works ?


In a brute-force attack each and every combination of letters symbols and numbers are converted into their hash forms and are then compared with the password hash which is to be cracked in other words you are literally taking every possible password that can exist convert it into its hash and check if the hashes match.

So yes it literally takes forever to crack a strong password using this method however the computer's processing speed is fast enough then yep simple passwords can be cracked easily by this method.

What is Salting ?


A new technique called Salting is introduced by security analysts to care hackers a hard time in cracking passwords.

In this technique a specific combination of characters are inserted at specific positions of the plaintext password before hashing.

Every company has its own salting algorithm and they don't make their salting algorithm public.

For example
Let's say Facebook salting algorithm inserts a string F%&2P at the beginning after the third character and at the end of the plaintext password.
After salting the password the salted password is then hashed by a hashing algorithm.
So when a salt is used rainbow tables are of no use even if the password to be cracked is a weak and commonly used password because the hash of the password without salting do not match the hash of the password which is salted also brute-force attack and dictionary attack are not effective to crack salted passwords unless the hacker already knows the salting algorithm employed by a company.

Comment down below if you have any doubts.

Thank You......