Level 1 · 1A Passwords · Lesson 1 of 3
Why a short password falls in seconds
Passwords aren't "guessed" like in the movies: a program tries combinations at full speed. That's called brute force. A regular computer tries millions of passwords per second, and one with graphics cards, billions.
That's why length matters so much. Every extra character multiplies the attacker's work: a 3-digit code has 1,000 combinations, a 4-digit one has 10,000. With letters, numbers and symbols, each character multiplies the work by dozens.
The first things they try
Before going through every combination, attackers try lists of common passwords (123456, qwerty, password), names, sports teams and dates with a year (Mateo2015, Chelsea1905). If your password is one of those, it falls in the first second, even with a capital letter and a number.
Two defenses worth their weight in gold
A different password for every account: if a website gets hacked and leaks your password, attackers try it on your email, your bank and your social media. And two-step verification (2FA): even if they steal your password, they still don't have the code from your phone.
Going deeper
What a website does with your password
A well-built website does NOT store your password exactly as you typed it, but a mathematical "fingerprint" of it called a hash. It also mixes in a random value, the salt, which is different for each person. That way, two people with the same password get different fingerprints, and the attacker can't reuse their work.
const sal = crypto.getRandomValues(new Uint8Array(16));
const base = await crypto.subtle.importKey(
'raw', new TextEncoder().encode(clave), 'PBKDF2', false, ['deriveBits']);
const huella = await crypto.subtle.deriveBits(
{ name: 'PBKDF2', hash: 'SHA-256', salt: sal, iterations: 100000 },
base, 256);- Line 1: creates 16 random bytes. That's the salt (called sal in the code).
- Lines 2-3: turns your password (clave) into a format the browser or the server understands.
- Lines 4-6: calculates the fingerprint (huella) by repeating the calculation 100,000 times. It's slow ON PURPOSE: for you it's a fraction of a second, but for an attacker trying millions of passwords it makes everything much slower.
This very app stores your password this way. If you want to see it, it's in the file src/util.js, function derivarClave. Today about 600,000 rounds or algorithms like Argon2 are recommended; this app uses 100,000 because that's the maximum its server (Cloudflare Workers) allows.
Review questions
An attacker is trying number-only codes. How much more work is a 5-digit code than a 4-digit one?
Answer: Ten times more combinations. Each extra digit multiplies the combinations by 10: you go from 10,000 to 100,000. The same happens with passwords: every extra character multiplies the work.
Which of these passwords falls first?
Answer: Chelsea1905. A team plus a year is on every list attackers try first. The other two are long and random.
What is two-step verification for?
Answer: So that stealing the password isn't enough to get in. It asks for a second proof, like a code on your phone. Even if someone has your password, they're still missing that step.