An experiment by Home Security Heroes shows how an AI-powered tool managed to crack more than half of the passwords entered in a minute. Within an hour, the tool retrieved 65 percent of the passwords.

For the experiment, cybersecurity company used PassGAN, a new type of password cracker. Where such tools typically rely on datasets, PassGAN is powered by two neural networks. One learns to generate passwords and the other learns to distinguish between the generated passwords and the passwords that come from real data breaches.

As the neural network gets more trained, it learns to make more sophisticated password predictions, so it can be used to crack passwords faster.

For the experiment, Home Security Heroes fed more than 15 million passwords from the 2009 RockYou breach into the tool. This data set is more commonly used to train password cracking tools.

The tool was able to crack 51 percent of common passwords within a minute. After an hour, the tool had retrieved 65 percent of the passwords. After one day the tool knew 71 percent of the passwords and after one month 81 percent.

15 characters, lowercase, uppercase, numbers and punctuation

Based on their discoveries, Home Security Heroes offers advice to better protect your passwords from such tools. For example, the company advises against reusing passwords. The company also recommends changing your passwords regularly.

According to Home Security Heroes, a good password is at least 15 characters long and contains lowercase and uppercase letters, numbers, and punctuation marks. The more random a password is, the longer it takes to crack it, the company concludes from its research.

Home Security Heroes writes in a blog that a randomly selected 18-character password consisting of lowercase letters, uppercase letters, numbers and punctuation marks currently takes 6 trillion years (a billion times a billion years) to be cracked.
The latter applies to the technology available today. With the huge leaps AI technology is currently making, we can be sure that even those long, random passwords won’t be able to cope with AI-powered password crackers in the future. Against this background, more and more initiatives are emerging to make passwords disappear completely.