Password attacks have been a problem since the beginning of network security, and they continue to be a dominant problem in current network security. Every year SplashData publishes a report on the most commonly used passwords that are leaked online. In 2018, they analyzed over 5 million leaked passwords and created a report based on how commonly passwords are used. The password "password" was number two on the list. Five of the top 10 were numeric sequence passwords starting with 1 and varying only in the length of the sequence (for example, 123456). There were a few clever yet still poor passwords such as iloveyou and letmein. Most of the remaining top passwords were simple dictionary words, often all in lower case. According to SplashData, almost every tenth user selected at least one of the 25 top most common passwords for at least one of their services.
自網路安全發展之初，密碼攻擊就一直是個問題，時至今日仍是網路安全中最主要的問題之一。SplashData 每年都會發布一份報告，列出網路上外洩、最常被使用的密碼。2018 年，他們分析了超過 500 萬筆外洩密碼，並依使用頻率製作了一份報告。「password」這個密碼在榜單上排名第二。前十名中有五個是以 1 開頭、僅在數字序列長度上有所不同的純數字密碼（例如 123456）。也有一些自認聰明、實際上仍然很弱的密碼，例如 iloveyou 與 letmein。其餘大多數常見密碼都是簡單的字典單字，且經常全部使用小寫字母。根據 SplashData 的資料，幾乎每十位使用者中就有一位，在其至少一項服務中選用了前 25 大最常見密碼之一。
Attackers have several methods of obtaining user passwords; here are some of these methods:
攻擊者有多種方法可以取得使用者密碼，以下是其中幾種方法：
- Guessing: To perform password guessing, an attacker can either manually enter passwords or use a software tool to automate the process. Truly bad passwords can be susceptible to a lone attacker making informed guesses.猜測：攻擊者可以手動輸入密碼，或使用軟體工具自動化這個過程來執行密碼猜測。真正糟糕的密碼很容易被單一攻擊者藉由合理推測而猜中。
- Brute force: Brute force password attacks are performed by computer programs called "password crackers." A password cracker performs a brute force crack by systematically trying every possible password until it succeeds. For example, it may start by trying all one-character passwords, then move to two-character passwords, and so on, trying all possible combinations until one works. The speed at which an attacker can obtain a password with this method may depend upon the speed of the attacker's computer (how many calculations it can perform per second), the speed of the attacker's internet connection, and the length and complexity of the password. Many password crackers are available, and many of them are available at no cost.暴力破解：暴力破解密碼攻擊是由稱為「密碼破解工具」的電腦程式來執行。密碼破解工具會有系統地嘗試每一種可能的密碼，直到成功為止。舉例來說，它可能先嘗試所有單一字元的密碼，再嘗試雙字元密碼，依此類推，嘗試所有可能的組合，直到其中一個成功。攻擊者以此方式取得密碼所需的速度，可能取決於攻擊者電腦的運算速度（每秒能執行多少次運算）、攻擊者網際網路連線的速度，以及密碼的長度與複雜度。市面上有許多密碼破解工具，其中很多是免費提供的。
- Dictionary attacks: Dictionary attacks use word lists to structure login attempts. The word lists can contain millions of words, including words from natural language dictionaries and words such as sports team names, profanity, and slang. Dictionary attacks are not always successful and are often attempted before a brute force attack. In some ways, however, a dictionary attack is similar to a brute force attack. It is an automated process that is performed by a password cracker program; the speed at which it enables the attacker to obtain a password may depend upon the speed of the attacker's computer (how many calculations it can perform per second), the speed of the attacker's internet connection, and the length and complexity of the password; and many dictionary attack tools are available for free on the internet.字典攻擊：字典攻擊使用單字清單來組織登入嘗試。這份單字清單可能包含數百萬個單字，包括自然語言字典中的單字，以及運動隊伍名稱、粗俗用語、俚語等字詞。字典攻擊並非每次都會成功，通常會在暴力破解攻擊之前先行嘗試。不過在某些方面，字典攻擊與暴力破解攻擊十分類似：它同樣是由密碼破解工具程式自動執行；攻擊者藉此取得密碼所需的速度，同樣可能取決於攻擊者電腦的運算速度（每秒能執行多少次運算）、攻擊者網際網路連線的速度，以及密碼的長度與複雜度；而且網路上也有許多免費提供的字典攻擊工具。
A password attack can be either an online attack or an offline attack. In an online attack, an attacker makes repeated attempts to log in. The activity is visible to the authentication system, so the system can automatically lock the account after too many bad guesses. Account lockout disables the account and makes it unavailable for further attacks during the lockout period. The lockout period and the number of allowed login attempts are configurable by a system administrator.
密碼攻擊可分為線上攻擊與離線攻擊兩種。在線上攻擊中，攻擊者會反覆嘗試登入，這種活動對驗證系統而言是可見的，因此系統可以在錯誤嘗試次數過多後自動鎖定帳戶。帳戶鎖定會停用該帳戶，使其在鎖定期間內無法用於進一步的攻擊。鎖定期間與允許的登入嘗試次數，皆可由系統管理員設定。
Offline attacks are far more dangerous. In an online attack, the password protects the system in which it is stored, but there is no such protection in offline attacks. In an offline attack, the attacker captures the password hash or the encrypted form of the password. The attacker can then make countless attempts to crack the password without being noticed. The longer and more complex a password are, the more difficult and time-consuming it is for attackers to crack it.
離線攻擊的危險程度遠高於線上攻擊。在線上攻擊中，密碼保護的是儲存密碼的系統本身，但離線攻擊並沒有這種保護。在離線攻擊中，攻擊者會擷取密碼雜湊值或密碼的加密形式，之後便能在不被察覺的情況下，反覆嘗試破解該密碼。密碼越長、越複雜，攻擊者破解起來就越困難、也越耗時。
Many authentication systems require a certain degree of password complexity. Specifying a minimum length of a password and forcing an enlarged character set (uppercase, lowercase, numeric, and special characters) can greatly influence the feasibility of brute force attacks. However, if users attempt to meet the enlarged character set requirements by making simple adjustments, such as capitalizing the first letter and appending a number and an exclamation point (changing, for example, unicorn to Unicorn1!), little is gained against a dictionary attack using some simple transforms.
許多驗證系統都要求密碼具備一定程度的複雜度。指定密碼的最小長度，並強制要求使用擴充字元集（大寫、小寫、數字與特殊字元），能大幅影響暴力破解攻擊的可行性。然而，如果使用者只是以簡單的調整方式來符合擴充字元集的要求，例如將第一個字母大寫並在後面加上一個數字與一個驚嘆號（例如把 unicorn 改成 Unicorn1!），那麼在面對使用一些簡單變換手法的字典攻擊時，這種做法幾乎起不了什麼防護效果。