AI doesn't just guess passwords anymore; it is learning them. Passwords that took hackers years to crack can now be cracked in seconds with machine learning models. Weak, short, or reused passwords are essentially unlocked doors for AI-powered cracking machines.

AI Password Cracking in 2025: Key Findings

AI-powered password cracking has become dramatically faster in 2025, with 85.6% of common passwords now crackable in under 10 seconds[1]. This acceleration stems from two main factors: advanced AI models that learn password patterns and powerful consumer GPUs.

Hardware Advances

The latest consumer graphics cards, particularly the RTX 5090, have transformed password cracking capabilities. Hive Systems reports that a setup of 12 RTX 5090s is now used as the benchmark for modern password cracking attempts[2].

Time to Crack by Password Type

For bcrypt-hashed passwords (work factor 10):

  • 8 characters or less: Instant crack regardless of complexity
  • 10 characters with mixed characters: 27 years
  • 12 characters with mixed characters: 244,000 years
  • 16 characters with mixed characters: 19 trillion years[2:1]

AI’s Impact

AI tools like PassGAN have revolutionized cracking by:

  • Learning common password patterns
  • Recognizing user habits like capitalizing first letters
  • Predicting likely passwords instead of random guessing[1:1]

Security Recommendations

Recent findings emphasize:

  • Length over complexity (minimum 16 characters)
  • Use of password managers
  • Implementation of Multi-Factor Authentication (MFA)
  • Adoption of passkeys where available[3]

  1. Messente - How Quickly Can AI Crack Your Password? ↩︎ ↩︎

  2. Hive Systems - Are Your Passwords in the Green? ↩︎ ↩︎

  3. Forbes - AI Can Crack Your Passwords Fast—6 Tips To Stay Secure ↩︎

  • slazer2au@lemmy.world
    131·
    16 days ago

    Oh, AI has nothing to do with it. It grabs the RockYou password list and guesses a password based on frequency of use.

    This is nothing new.

    If they want to do something actually impressive how fast can they crack sha256 hashed passwords without rainbow tables. I will let them off and not require any salting.

    • adminofoz@lemmy.cafe
      1·
      5 days ago

      Here is the thing, does the corporate entity you work with use Microsoft? Then your password is stored as an NTLM hash in NTDS.dit. That means you are using MD4.

      Has anyone in your organization clicked a phishing link? It only takes one weak link to get in. Then it only takes one (Maybe 2) bad configuration for a malicious actor to escalate privileges. Then dump the whole organization passwords from the Domain Controller.

      Hope you aren’t reusing passwords anywhere.

      • slazer2au@lemmy.world
        1·
        5 days ago

        We are all running password less with passkeys so our Entra passwords are all 128 length randomised that even we don’t know because why should we?

        Corporate phishing tests are a joke, you can bypass them by filtering for Phishme or kb4 in the email header.

          • slazer2au@lemmy.world
            1·
            5 days ago

            From something i read a while ago when you enable passwordless entra resets your password to something that stupidly long I don’t actively make them that long even in my password manager.

            I’d never heard of bypassing a corporate phishing test using an email filter.

            https://github.com/postmodern/phishing-training-sigs
            Add a rule in outlook/thunderbird if any of those are in the email header toss it to a folder specially for phishing emails. Doing it org wide makes no sense as you say but if you know enough about emails to read the email header you likely aren’t the target for the phishing training.

            I am well aware of evilnginx :D

  • CubitOom@infosec.pub
    5·
    16 days ago

    I still don’t really understand what passkeys are since I’ve only ever been introduced to them by companies like Google and Microsoft. Are there any open source implementations of passkeys?

    Also, why does no one ever recommend SSH keys, or GPG keys as an alternative method?