These days, logging into your computer or any online service with a weak password is like leaving your front door half open. We're aware of the risk, but we still use easy, repetitive passwords full of predictable patterns. The problem is that attack tools have taken a massive leap forward. Thanks in large part to the power of GPUs and the use of algorithms and AI, many of the passwords we consider "acceptable" can be cracked in a matter of minutes.
Various studies by cybersecurity companies show that most of the real passwords we use for our accounts can be cracked in less than a day , and even in less than an hour. At the same time, Microsoft is pushing for a paradigm shift: leaving behind weak passwords and SMS authentication and moving towards more robust methods like passkeys, especially in Windows environments. If you want to prevent your Windows account (and the rest of your services) from being the next victim, you'll want to understand what's happening.
Why a short password can be cracked in less than a day
Analyses of large credential breaches leave a clear message: the actual resistance of a password against automated attacks is much lower than we usually imagine . Kaspersky has studied, over different periods, databases of between 193 and 231 million passwords exposed in massive breaches between 2023 and 2026, simulating attacks with current hardware and algorithms.
One of these studies concludes that around 60% of the most common passwords can be cracked in approximately one hour . And nearly 68% can be cracked in less than a day . In another similar analysis, with a sample of 193 million passwords, the results are even more worrying: 45% are broken in less than a minute, and only 23% withstand more than a year against systematic brute-force attacks and advanced algorithms. Quite alarming.
These calculations assume the use of a single, high-end, modern GPU. In practice, cybercriminals typically combine multiple GPUs in parallel and use specialized software that maximizes the hardware's capabilities. This means that actual attack times can be even shorter.
The technical conclusion is simple: a short password, up to 8 characters, almost always falls into the category of "crackable in less than a day ." And the worst part is that many longer passwords aren't safe either if they follow predictable patterns that cracking tools have already thoroughly analyzed.
When analyzing the longer passwords in the sample (for example, 15 characters), it is observed that more than 20% of them can also be cracked in less than a minute using optimized algorithms and lists of common patterns. This demonstrates that length alone is no longer a guarantee of security.
Dangerous patterns: numbers, symbols, and dates that give away your password
Kaspersky's studies of hundreds of millions of leaked keys show that most are not "random" at all. The same patterns repeat themselves over and over . This allows attackers to drastically reduce the actual search space and speed up decryption.
In the case of numbers, the data is very clear: more than half of the passwords analyzed, around 53%, end in numbers . Another 17% begin with numbers, and nearly 12% include sequences reminiscent of dates between 1950 and 2030 (birth years, anniversaries, etc.). In other words, many people end their password with their birth year. Crazy.
Furthermore, around 3% of passwords include keyboard patterns like "qwerty" or its reverse "ytrewq," and predictable numerical sequences such as "1234" or similar continue to appear. These are mental shortcuts we use to remember our passwords. Very useful, but also the first ones that attack tools try.
The same applies to symbols. Among the leaked passwords containing a single special character, the most frequently used symbol by far is the at sign (@), present in around 10% of cases . This is followed by the period (.) at approximately 3% and the exclamation mark (!) at a smaller percentage, close to 1%. Again, these are usually placed at the beginning or, especially, at the end of the password.
Alexey Antonov, head of Kaspersky's Data Science team, summarizes the problem: if attackers know the most frequent patterns, the number of combinations they actually have to try is drastically reduced . They no longer need to explore the entire theoretical space of possible passwords, but instead focus on highly probable combinations, making it "fast" to crack a large number of real-world passwords.
Emotional words, viral trends, and other predictable shortcuts
Beyond numbers and symbols, a huge portion of passwords are constructed from everyday words. Kaspersky studies indicate that many passwords are based on emotionally charged terms or trendy concepts at a particular time.
Between 2023 and 2026, for example, a striking increase was detected in passwords incorporating the word "Skibidi," a very popular meme during that period. At the same time, positive words like "love," "magic," "friend," "team," "angel," "star," and "eden" predominate , while negative words such as "hell," "devil," "nightmare," and "scar" also appear.
The problem is that these terms are so common that password dictionaries already include them by default . Using a single word, even with a number at the end or a symbol in the middle, still leaves a very predictable structure for attack algorithms. The software first tries the most typical words (with uppercase and lowercase variations) and then starts combining them with suffixes like "1", "123", "!" or specific years.
That's why experts recommend avoiding single words, no matter how much personal attachment we have to them. Instead, the most effective approach is to use long password phrases made up of several seemingly unrelated words , incorporating numbers and symbols in inconspicuous positions and even with small, intentional variations. This combination of length, randomness, and lack of a recognizable pattern significantly increases the time needed to crack the password.
Length matters… but it's no longer enough.
For years we've been led to believe that "the longer the password, the better." That idea is still partly true, but recent data indicates that simply increasing the length is no longer enough if we continue to include patterns that cracking tools know by heart.
Kaspersky's analysis shows that while longer passwords are generally stronger, length alone is no longer a guarantee . With the help of advanced algorithms and even artificial intelligence techniques, attackers can target logical structures that are very common among users: name + year, word + number + symbol, keyboard combinations, and similar patterns.
Hence the striking figures, such as the fact that over 20% of 15-character passwords can be cracked in less than a minute if they maintain predictable structures. At the opposite extreme, only around 23% of all the keys analyzed in one of the studies can be considered truly robust, meaning they would take more than a year to crack by brute force under the experimental conditions.
In practice, this means that a 10 or 11 character password that follows obvious patterns can be much weaker than a random 4 or 5 unrelated word phrase that easily exceeds 16 characters and mixes letters, numbers, and symbols in an unintuitive way.
The current consensus among multiple security actors is that, today, a secure password should have more than 16 characters , use uppercase and lowercase letters, include numbers and symbols and, above all, not follow any obvious pattern (no significant years, common words, keyboard sequences or typical substitutions like “a” for “@”).
Brute force attacks, dictionary attacks, and password cracking
To understand why all of the above is so critical, it's helpful to review how criminals actually attack our accounts. There isn't a single method, but rather several strategies that combine to increase the chances of success and reduce the risk of detection.
In a classic brute-force attack against a single account, the attacker tries all possible combinations of characters for a given length until they find the correct one. Although it may seem slow, with powerful GPUs and weak hashes, millions or even billions of combinations can be tried per second. This is especially true if unlikely patterns have been removed beforehand.
Dictionary attacks , instead of trying completely random combinations, use huge lists of common words, phrases, and patterns (names, popular terms, frequent dates, etc.), with automatic variations (uppercase letters, typical substitutions, numeric suffixes, etc.) to target a specific account. This makes them much more efficient because they focus on how we actually create passwords.
Password spraying works in the opposite way: instead of targeting a single account, the attacker chooses a common password (for example, "Password123" or "123456") and tries it on a massive array of different accounts. With this technique, they reduce the number of attempts per account, more easily bypass automatic lockouts, and still find users who continue to use extremely weak passwords.
For individual users, the risk is that this widespread attack could affect everyday services: email, social media, shopping platforms, or online banking . Browsing the internet safely and implementing basic security measures greatly reduces the impact. A single lucky password combination on any of these accounts can lead to identity theft, online impersonation, a chain of password changes, or even direct financial losses.
Reusing passwords: the mistake that opens many doors at once
One of the messages experts repeat most often is that each account should have a different password . And it's not just a whim. As soon as one of your passwords appears in a data breach, attackers use it to try to gain access to any other service where they suspect you might have an account (email, social media, banking, cloud storage, etc.).
This approach is known as credential stuffing . It uses real username and password combinations obtained from a previous breach and attacks them against multiple websites and platforms, relying on the fact that many users will reuse the exact same password or only minor variations.
If your Instagram password is the same as your email password, and that username/password combination is leaked in an attack, criminals can gain direct access to your email , from which it is relatively easy to reset passwords for other accounts, authorize changes, or perform social engineering by impersonating you.
Therefore, one of the key points in all the recommendations is to combine strong passwords with a clear policy of not reusing them . It might seem more inconvenient at first, but it becomes perfectly manageable if you use a modern password manager that takes care of everything.
How to create truly secure passwords today
The good news is that you don't need to be a tech expert to secure your accounts. With a few simple guidelines, you can significantly increase the level of protection , even against systematic and automated attacks.
First and foremost, avoid at all costs the use of obvious personal data: first names, last names, trivial nicknames, dates of birth, anniversaries, or phone numbers . These are among the first things tested in both targeted attacks and massive dictionary attacks.
Instead, consider using long passphrases with several unrelated words, interspersing numbers and symbols in unexpected places. Play with irregular uppercase and lowercase letters, introduce a letter in place of an unusual number, and avoid using numbers that correspond to dates with personal significance.
Some practical tips drawn from recommendations by companies like Kaspersky or Qualiteasy would be:
- Always exceed 16 characters when possible.
- Mix different types of characters (letters, numbers, and symbols).
- Do not repeat patterns across different services.
- Renew the most sensitive passwords periodically, especially if you suspect a breach.
To reduce the effort of remembering dozens of complex passwords, use a reliable password manager . These applications store all your logins in an encrypted database that you access with a single, strong master key. They also typically include automatic random password generators and autofill features, cross-device syncing, and, in some cases, passkey management.
Companies like Kaspersky have also added free tools to their websites to check if a password has already been leaked in known breaches and to automatically generate strong passwords. Even if you don't want to use their full password manager, these types of services are very useful for assessing the risk of your current passwords.
How to specifically protect your account in Windows
In the Windows environment, your account security depends on more than just password complexity. How you log in, how you manage your credentials, and what additional security measures you enable make a big difference . Here's what you need to do:
- Set up a strong password for your Microsoft accountThat is, more than 16 characters, a mix of character types, no personal data, and no typical patterns. If you maintain a local user account, apply the same security criteria to it, even if you only use it occasionally.
- Activate multi-factor authentication (MFA) on your Microsoft accountThis adds a second check when signing in to Microsoft services (Outlook, OneDrive, Xbox, etc.). And in many cases, it also strengthens the Windows sign-in process if you're using your online account.
- Activate Windows Hello (if your PC is compatible)This allows you to log in using facial recognition, fingerprint, or a PIN associated with the device.
- Regularly review your recent Microsoft account activity.Check for logins from unknown locations or devices, enable security notifications to alert you to suspicious behavior, etc.
- Verify that your equipment has a good level of general protectionThis means: keeping Windows Defender updated, maintaining an up-to-date operating system, being wary of phishing links and email attachments, etc.
MFA, TOTP, SMS and the push of passkeys
In recent years, Microsoft and other major vendors have begun recommending a significant shift in authentication. Under their core identity hardening strategy , they encourage avoiding certain MFA factors considered weak or easily subverted.
In particular, they advise against using one-time codes sent via SMS , OTPs via email, and even codes generated by time-based applications (TOTPs) as the sole additional security measure. SMS messages are vulnerable to SIM swapping and line hijacking attacks. Conversely, email OTPs become ineffective if the attacker already has access to the email inbox.
Regarding TOTPs, the main concern is that they can be targeted by phishing or man-in-the-middle attacks . If you enter the code on a fake website or in an intercepted session, an attacker can reuse it in real time to access your account. They are still much better than having nothing, but they are no longer considered the ultimate goal in terms of security.
In this context, Microsoft recommends promoting the use of passkeys and standards-based methods such as FIDO2 , which rely on public-key cryptography and trusted devices (mobile phones, physical security keys, etc.). These types of solutions are inherently resistant to many phishing attacks.
That doesn't mean you have to abandon your TOTP applications if you're using them. They remain a valuable layer of protection against simple attacks and are better than relying solely on your password. However, if you have the option to enable physical passkeys or security keys on your critical accounts, it's a significant step towards a passwordless model.
How to defend yourself against password spraying and other attacks
Although the attacks may sound very sophisticated, most of the protection is in your hands with good basic habits . You don't need to be a system administrator to drastically reduce the chances of falling victim to password spraying or credential stuffing. Three tips:
- Activate some form of multi-factor authentication on all platforms that allow it.While some methods aren't perfect, they add an extra layer of protection that's usually enough to thwart most mass attacks. Prioritize more secure solutions when available (passkeys, physical keys, Windows Hello, etc.).
- Enable login alerts and security notifications wherever possible. That way, if someone tries to access your account from a foreign country or an unknown device, you'll receive an immediate notification. This allows you to react by changing your password or logging out.
- Adopt a healthy skepticism mindsetBe wary of links that ask for your credentials, even if they appear official, and avoid connecting from unsecured public computers. Don't share your password with anyone, and periodically review your account recovery settings (alternate email, mobile number, security questions) to ensure there are no suspicious changes.
Opting for long, random, and unique passwords, using password managers, enabling multiple authentication factors, and, in the case of Windows, taking advantage of options like Windows Hello or passkeys transforms that "half-open door" into a much stronger barrier against automated attacks and cybercriminals who have the upper hand.
