A salaried professional sitting in their office in Bengaluru opens a new tab. They navigate to what looks exactly like the HDFC net banking portal. The domain looks right. The padlock is there.

They type in their Customer ID. They type in a 16-character password—a random string of letters, numbers, and symbols that would take a supercomputer millions of years to crack. Their phone buzzes with an OTP. They enter the 6 digits.

Three minutes later, ₹4,50,000 leaves their account.

They did everything right. Their password was impenetrable. Their phone was in their hand. So how did the money move? Because the security industry has spent two decades selling you a lie about what authentication actually is.

A password is not security. It's proof.

When people think about hackers stealing passwords, they imagine a cinematic barrage of code forcefully breaking down a digital door. They ask, "Is my password strong enough to withstand the attack?"

That is the wrong question. No professional adversary sits at a terminal trying to brute-force a strong password character by character. It is mathematically inefficient and incredibly loud. It triggers alarms.

Instead of attacking the password, they attack the human. They attack the infrastructure. They attack the places where you used that exact same password seven years ago.

There are five distinct ways someone takes your digital identity. Only one of them relies on a computer doing math. And the most dangerous one on the list isn't an attack on your password at all.

Guessing is exactly what it sounds like. Manually or automatically attempting the most statistically probable passwords for a specific target.

You don't need a supercomputer to break an account if the user has essentially left the key under the doormat. Attackers don't guess randomly; they guess based on datasets of human psychology.

According to NordPass data on Indian internet users, 123456 was used over 3 lakh times. admin hit 1.18 lakh. And when systems mandate a capital letter, a symbol, and a number? People just pivot to India@123 or bigbasket.

Why does it work? Because humans are fundamentally predictable when told to invent something memorable.

If your password is on that list, you don't have a password. You have a hint.

Cracking happens offline. Attackers steal a database of encrypted passwords (hashes) and use immense computational power to reverse them.

When you sign up for a service, they don't store your actual password. They run it through a one-way math equation called a hashing algorithm (like bcrypt). If hackers breach the server, they get the hashes, not the passwords. They then take those hashes to a rig of highly powerful GPUs and rapid-fire guesses until the math matches.

This is where password length—entropy—actually matters. Every additional character exponentially increases the math required.

ELI5: Hashing is like turning a potato into mashed potatoes. It's easy to do. But if a hacker steals the bowl of mashed potatoes, cracking is the process of trying to perfectly re-assemble the original potato.