I want to discuss a critical topic that impacts us all: password security. AI can help attackers generate password guesses, but dramatic cracking statistics need context. In 2023, Home Security Heroes reported testing PassGAN against a list of 15,680,000 leaked passwords and claimed that 51% could be cracked in under a minute. That is a claim about its test—not evidence that 51% of all online accounts can be compromised in a minute.
Understanding PassGAN: AI-Powered Password Cracking
PassGAN (password generative adversarial network) learns patterns from leaked passwords and generates new password guesses. The original research, first posted in 2017, explored replacing hand-crafted password-generation rules with machine learning. Traditional cracking tools also automate guessing; they do not depend on a person manually analyzing every password.
The same 2023 commercial test reported cracking 71% of its password list in less than a day and 81% in less than a month. These figures should not be treated as universal predictions. As NIST explains, guessing against a live login page differs from an offline attack against stolen password hashes. Login rate limits can restrict online guesses; offline resistance depends on factors including password strength, the password-hashing scheme and the attacker's computing resources.
Strengthening Your Password: Stay Ahead of AI
To protect ourselves from password-guessing tools, AI-driven or otherwise, we should prioritize length, unpredictability and a different password for every account. A password manager can generate and store strong, random passwords. If you need to remember a password, a long passphrase can help. No particular length or combination of letters and numbers guarantees safety: phishing or other theft can bypass password strength entirely. See NIST's consumer guidance.
For context, NIST's July 2025 authentication guidelines require covered services to set a minimum of 15 characters when a password is the sole authentication factor; passwords used as part of MFA may have an eight-character minimum. These are requirements for service providers, not a guarantee of security at either length. NIST also prohibits mandatory character-mixture rules and routine password expiration.
Key Takeaways: Keep Your Passwords Cyber Smart
- Embrace long, unpredictable passwords: Aim for at least 15 characters, and longer where practical. Prefer randomly generated passwords or a long passphrase over predictable substitutions. Adding a number or symbol does not automatically make a weak password strong.
- Enable 2FA/MFA: Two-factor authentication (2FA) or multi-factor authentication (MFA) adds an extra layer of security to your accounts. Opt for non-SMS-based methods when possible. Prefer phishing-resistant FIDO/WebAuthn options, such as security keys, when available; CISA explains why these offer stronger protection.
- Avoid password reuse: Using unique passwords for each account minimizes the risk of multiple account breaches if one password is compromised.
- Use auto-generated passwords: Many password managers can generate strong, random passwords for you, making it easier to maintain secure accounts.
- Change compromised passwords promptly: Do not change a strong, unique password merely because a calendar reminder says it is time. Change it if there is evidence it has been compromised, and replace it anywhere else you reused it. This follows NIST's guidance against routine password expiration.
- Use public WiFi carefully: You do not need to avoid every public network. The FTC says public Wi-Fi is usually safe because most websites encrypt connections. Check for HTTPS, heed browser security warnings and verify that you are on the intended website. Encryption protects the connection; it does not prove that a website is trustworthy.
As AI continues to advance, it's crucial for us to stay informed and adapt our password habits to keep our accounts safe. By following the takeaways outlined above, we can better protect ourselves from password-guessing tools like PassGAN and other account threats. Stay #cybersmart and safeguard your online presence.