History of Password Cracking

The history traces password protection from exposed plaintext to deliberately expensive one-way hashing. In 1965, a CTSS file-handling flaw caused the password file to be printed publicly; Multics responded in 1971 by storing scrambled passwords instead. Unix’s 1979 crypt(3), developed by Robert Morris and Ken Thompson, established a lasting model: transform passwords irreversibly, add a per-user salt to defeat reusable lookup tables, and make each guess costly. Its modified DES scheme limited passwords to eight characters and repeated encryption 25 times. The term “cracking” became associated with password attacks through Alec Muffett’s 1991 wordlist-and-rule program, though the method is guessing passwords and comparing their hashes, not decrypting them.

Subsequent developments show attackers and defenders adapting to each other. Weak or fast formats such as LM, NTLM, and unsalted hashes enabled efficient guessing and rainbow-table attacks; tools including John the Ripper, L0phtCrack, and hashcat made recovery accessible across platforms and increasingly powerful hardware. Separate tools such as Hydra and Medusa target live login services rather than stolen hashes. Bcrypt, scrypt, and Argon2 raise the cost of offline attacks through adjustable computation or memory requirements. The timeline also highlights that cracking is only one route to credentials: malware, network name-resolution tricks, and memory-extraction tools can expose passwords or hashes directly. The central security lesson is to use salted, slow password functions and avoid formats that make guesses cheap.