Crack your own passwords to see how strong they really are
The fastest way to understand why one password is safe and another is not is to attack them yourself. In this mission you install the two best-known password crackers, hashcat and John the Ripper, inside WSL2. Then you invent a few passwords, turn them into hashes the way a real site stores them, and point the crackers at your own hashes. A weak one falls in about a second. A long passphrase does not fall at all: the number of guesses needed is larger than the tool can even count. Everything here happens against hashes you made up on your own machine, which is the one lawful way to do this. You leave with a concrete rule for your own passwords, and the evidence behind it.
- Windows 11 with WSL2 (a slim Linux built into Windows). If you did the Build a hacking lab lesson you already have it. If not, open PowerShell as Administrator, run
wsl --install, restart, and let Ubuntu finish its first-time setup. On a real Linux box or a Mac you can follow along in your normal terminal instead. The Level 0 lesson Install anything from GitHub covers the terminal basics if they are new to you - About 1GB of free disk space for the two crackers and the CPU OpenCL runtime they need
- No GPU is required. A graphics card would make real cracking far faster, but the point of this mission is made as well on a plain CPU, and everything is written to run that way
- It helps to have seen Has your password leaked? first, so you know these ideas are not abstract: billions of real passwords are already in attackers' wordlists
The one rule, and why you crack your own
Fix the legal line in your mind before anything else, and understand what cracking a password actually is, so the rest of the lesson is clear.
- CarefulOnly ever crack hashes you created yourself, or that you have explicit written permission to test. Cracking someone else's password, or running these tools against any account, login or file that is not yours, is a criminal offence in the UK (the Computer Misuse Act 1990) and almost everywhere else, even if you cause no damage and even if you were only curious. Everything in this mission is done against hashes of passwords you make up on your own machine. That is the one lawful way to learn this, and it is the only way used here.
When a website stores your password, it does not keep the password itself. It keeps a hash: the result of running the password through a one-way maths function. Feed the same password in and you always get the same hash out, but there is no way to run the function backwards and turn the hash into the password. So when you log in, the site hashes what you typed and checks it matches the hash it stored. If the site is ever breached, what leaks is the file of hashes, not the passwords.
Cracking is how an attacker turns those stolen hashes back into passwords, and it is not by reversing the maths, because that cannot be done. Instead the attacker guesses: they take a candidate password, hash it with the same function, and see if the result matches a stolen hash. If it does, they have guessed your password. The whole game is making those guesses fast and making them clever. A modern machine makes hundreds of millions, or with a GPU many billions, of guesses a second.
That is the uncomfortable truth this mission makes concrete: the strength of your password is not whether someone can reverse it (no one can), it is how many guesses it would take to stumble on it. A password in a list of common ones is guessed instantly. A password that follows a predictable human pattern is guessed soon after. A long, unpredictable one is never reached, because the number of guesses needed is far too large. You are about to see all three happen.
You will use two tools, both free and both standard in the security world. hashcat is the best-known password cracker, normally run on a graphics card for speed; here it runs on your CPU. John the Ripper is the other classic, strong on the CPU and good at automatically recognising hash types. Having both installed is worth it: they teach the same ideas with slightly different commands, and professionals reach for one or the other depending on the job.
TipThis is the defend side of security, not the attack side. The reason to watch your own weak password fall is to never use one like it again, and to understand, in your gut rather than in theory, why the advice in the last step is the advice. You are the only target in this mission.