My password is twelve characters — is that enough?

Length is the right lever, and twelve characters from a real phrase beat eight twisted ones. But no length protects a password that's reused: in that case it doesn't need to be computed at all, it's already known elsewhere.

Why do we hear about passwords being "cracked" if sites don't store them?

Because they store a hash, which can't be reversed but can be matched by trying candidates until one produces the same value. A short or common password is found this way; a long one isn't, for lack of time.

Brute-force attack

In plain terms

Trying passwords one by one until one hits. On a live site, this gets blocked after a few tries — the real danger is elsewhere: a stolen password file, where the attacker tries without limit and with no one watching.

Definition

A brute-force attack is the systematic trial of passwords until the right one is found, either directly against a service or offline against a stolen database of password hashes.

How it works

Against a live service, this attack works poorly: the account locks after a few failures, and network latency limits the number of attempts. That's why it has largely given way to techniques that don't need to guess. It becomes formidable again in one specific case: when a database has been stolen. The service doesn't store passwords but their hashes, one-way calculations that can't be reversed — but that can be recomputed, by trying candidates until the same hash comes out. The attacker then works on their own machine, with no limit on attempts and no one watching. Password strength becomes decisive again, and for the first time length really matters: it's length, more than special characters, that puts the calculation out of reach.

Warning signs

A notification from a service announcing a breach of its credentials database
A series of failed login attempts on your account, flagged by the service
A temporary account lockout you didn't cause
An old, short, reused password on a service that had a breach

How to verify

Against a service, the login history and failed-attempt alerts are enough. Against a stolen database, there's nothing to check on your end: you learn about it from the service's notification. The right question isn't "was I attacked" but "is this password still used anywhere," since that's what decides what to do next.

What to do

Favor length: a phrase of several unrelated words beats a short word stuffed with symbols, because length is what makes the number of combinations to recompute explode. A password manager lets you have long and unique passwords without memorizing anything, and two-factor authentication makes the password alone insufficient.

If it already happened

After a service announces a breach, change the password there and everywhere it was reused, without waiting to learn whether it was actually cracked — the gap between the breach and its exploitation is exactly the window you have. Enable two-factor authentication and check recent logins.

Frequently asked questions

My password is twelve characters — is that enough?: Length is the right lever, and twelve characters from a real phrase beat eight twisted ones. But no length protects a password that's reused: in that case it doesn't need to be computed at all, it's already known elsewhere.
Why do we hear about passwords being "cracked" if sites don't store them?: Because they store a hash, which can't be reversed but can be matched by trying candidates until one produces the same value. A short or common password is found this way; a long one isn't, for lack of time.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Credentials and accounts family. Last updated: 2026-09-02.