Hackers Try "P@ssw0rd" Before They Try "password"
Password crackers start with millions of leaked passwords and apply every "clever" swap automatically. Length is what slows them down.
The script
You swapped the a for an at sign... and that's the first thing a hacker's computer tries.
Cracking programs don't guess random letters.
They start with lists of real passwords... millions, leaked from hacked websites.
Then they apply rules. Capital first letter. A becomes at. O becomes zero. Add a one, or an exclamation mark.
Every trick you thought was clever... is already a rule.
You see, on a stolen password file, a graphics card can test billions of guesses every second.
What actually slows it down... is length. Four random words beat any clever swap.
So if you're picturing your own password right now...
The facts, checked
- Tools such as Hashcat and John the Ripper run dictionary attacks with "rules" (e.g. Hashcat's best64.rule) that capitalise words, substitute characters such as a→@ and o→0, and append digits or symbols.
- Leaked password collections, e.g. RockYou (2009, about 32 million plaintext passwords), are the standard starting wordlists.
- Against fast, unsalted hashes (e.g. MD5, NTLM), a single modern GPU tests tens to hundreds of billions of guesses per second (Hashcat benchmarks). Slow hashes like bcrypt are far slower, so say "a stolen password file", not every site.
- Length dominates: four words picked at random from a large list (e.g. Diceware's 7,776) give about 51 bits, far beyond a substituted dictionary word.
