Which Password Falls First?

About this interactive

What you're doing: judging password matchups at TechKnowDJ, a fictional DJ and music-tech company. Each round shows two staff passwords facing the same attacker, and you commit to which one falls first, or whose account actually opens, before the reveal explains what really happens. Why it matters: most people judge a password by how complicated it looks, and attackers count on that. Real cracking does not start by trying every combination. It starts with passwords already leaked in breaches, then wordlists run through rules that add the capitals, swaps and trailing digits people think are clever, then masks for common shapes like a word followed by a year. Brute force comes last. So a password can look strong and still fall in seconds, a plain-looking one can hold out for decades, and a reused one can fall on the first try no matter how strong it is. How to use it: before you pick, ask two questions. Could the attacker predict this password, from a wordlist, a pattern, something public about the person, or an old leak? And does the attacker even need to guess, or does a second factor still stand in the way? The reveals give order-of-magnitude reasoning, not stopwatch times, because real speeds depend on how the passwords were stored.

What you'll learn

Predict which of two passwords an attacker recovers first by applying the order cracking actually runs in: leaked-password lists, then wordlists with rules and masks, and brute force last
Explain why length and unpredictability protect a password far more than complexity rules, character substitutions, keyboard patterns, repetition or personal information
Explain why a reused password, or a site-by-site variation of one, falls to credential stuffing however strong it is, and why multi-factor authentication can stop an attacker who already holds the correct password
Explain how a password manager makes long, random, unique passwords practical, and why its master password must be a strong passphrase that is never written down

Aligned to

CompTIA Security+

2.4 Given a scenario, analyze indicators of malicious activity.

4.6 Given a scenario, implement and maintain identity and access management.

CompTIA A+ Core 2

2.4 Explain common social-engineering attacks, threats, and vulnerabilities.

2.6 Given a scenario, configure a workstation to meet best practices for security.

CompTIA Tech+

6.5 Explain password best practices.

NIST 800-53

IA-5 Authenticator Management

IA-2 Identification and Authentication (Organizational Users)

Key terms

Dictionary Attack: A type of brute force attack that uses a predefined list of common words and phrases to guess passwords.
Mask Attack: A password cracking technique that exploits known patterns in passwords — such as a capital letter followed by lowercase letters and ending in numbers — to dramatically narrow the search space compared to a full brute-force attempt.
Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Credential Stuffing: An automated attack in which stolen username and password pairs from one breached service are systematically tested against other services to gain unauthorized access. It exploits users who reuse passwords across multiple accounts.
Password Reuse: The poor security practice of using the same password across multiple accounts, increasing exposure if one account is compromised.
Multi-Factor Authentication: An authentication method that requires users to provide two or more verification factors to gain access.
Password Manager: A secure application that stores and manages a user's passwords in an encrypted vault, requiring only one master credential for access. Password managers enable users to maintain strong, unique passwords for every account without memorizing them.
Passphrase: A sequence of words or a sentence used as a password, combining length and memorability to create a strong authentication credential.
Password Complexity: A security requirement that mandates passwords include a mix of character types such as uppercase letters, numbers, and symbols to reduce the risk of compromise.
Password Spraying: An attack that attempts a single commonly used password against many different user accounts before moving to the next password, deliberately staying below account lockout thresholds to avoid detection.
Data Breach: An incident in which protected or sensitive data is accessed, stolen, or disclosed without authorization, typically triggering legal notification requirements.

Topics

Interactive Predict

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →