How Hackers Steal Passwords: Phishing, Keyloggers, and More

Most password theft doesn't involve elaborate hacking. The most common attacks exploit human behaviour, reused credentials, and websites with weak security practices. Understanding the real methods — and how often each one succeeds — helps you prioritise the right defences rather than obsessing over unlikely threats while ignoring the obvious ones.

1. Phishing — the most successful attack

Phishing is the single most effective password theft technique — responsible for more than 80% of reported security incidents according to Verizon's annual Data Breach Investigations Report. An attacker creates a fake login page — visually identical to your bank, Gmail, or Microsoft account — and tricks you into entering your credentials. You type your real password into the fake site, the attacker captures it, and you're often redirected to the real site so you don't notice anything went wrong.

Defence: Always type URLs directly or use bookmarks — never follow links in emails to login pages. Enable two-factor authentication on every important account. Phishing captures your password, but with 2FA the attacker still can't log in. The strongest defence is a passkey or hardware security key: these are cryptographically bound to the real domain, making them completely immune to phishing — they will not authenticate on a fake site.

2. Data breaches and credential stuffing

When a company is hacked and its user database is stolen, your credentials — email, hashed password, sometimes plaintext — end up in attacker hands. You did nothing wrong. This happens constantly: billions of credentials from thousands of breaches are available in underground markets, typically for a few dollars per dataset.

Attackers then run credential stuffing: automated tools test stolen email/password combinations against hundreds of popular sites simultaneously. Success rates of 0.1–2% are common — which sounds small, but across 100 million stolen credentials, that's 100,000 to 2 million working logins.

Defence: Use a unique password for every single site. A breach at a low-security site you registered on five years ago becomes harmless if you never reused that password. Check whether your email has appeared in known breaches at HaveIBeenPwned.com, or use our Breach Checker to verify specific passwords.

3. Password spraying — bypassing lockouts

Traditional brute force (trying thousands of passwords against one account) triggers lockouts after a handful of failed attempts. Password spraying inverts this: rather than many passwords against one account, attackers try one common password against thousands of accounts.

"Spring2026!" is tested against a million email addresses — statistically, some percentage of users will have chosen it. Because no single account ever sees more than one failed login attempt, no lockout is triggered. This is particularly effective against corporate environments where employees follow predictable patterns (Company2026!, Welcome1!).

Defence: Generate your passwords randomly — no seasonal patterns, no company names, no predictable substitutions. A random 12-character password has zero overlap with any spray list. Use our Password Generator to create fully random passwords that no spraying dictionary will ever contain.

4. Keyloggers and malware

A keylogger is malware that records every keystroke on your device and transmits it to an attacker. Everything you type — including passwords, credit card numbers, and private messages — is captured in real time. More sophisticated variants (form grabbers) intercept data directly from browser form submissions before it's encrypted, bypassing HTTPS entirely.

Keyloggers arrive via: malicious email attachments (the most common vector), infected software downloads, drive-by downloads from compromised websites, and in rare high-value cases, supply chain compromise of legitimate software.

Defence: Keep your operating system, browser, and software updated — most malware exploits known vulnerabilities in unpatched systems. Don't open attachments from unknown senders. Use a reputable antivirus that provides real-time protection. For high-value accounts, a hardware security key provides complete protection even if a keylogger captures your password: the key's cryptographic challenge-response process can't be replicated without the physical device.

5. Brute-force attacks — guessing at scale

A direct brute-force attack tries every possible combination of characters until it finds your password. Against an online login form with rate limiting, this is impractical — most sites lock accounts after 5–10 failures. Against an offline stolen database (where the attacker has the hashed passwords), it's a different story.

Modern GPUs can compute billions of MD5 or SHA-1 hashes per second. If a site stored passwords with MD5 (as many older sites still do), an attacker with a stolen database can try an entire dictionary in seconds and crack any 8-character password using all character types within days. This is why the hash function matters enormously — and why you shouldn't trust sites with weak hashing to protect you.

Defence: Use passwords of 12+ random characters. You can't verify what hashing a site uses, so design for the worst case (MD5). A 12-character random password with all character types is safe against brute force even against a weak hash. Use our Password Strength Checker to see the estimated crack time for any password.

6. Man-in-the-middle attacks

A man-in-the-middle (MitM) attacker intercepts traffic between your device and a server. On properly configured HTTPS sites this is largely mitigated — your traffic is encrypted with a key only the server holds, and the certificate is verified by your browser. However, vulnerabilities remain.

Real-world MitM attacks today usually involve: malicious WiFi hotspots that perform SSL stripping (downgrading HTTPS to HTTP), compromised routers that serve fake certificates, and in enterprise environments, legitimate corporate proxies that decrypt and re-encrypt TLS traffic for inspection.

Defence: Look for HTTPS and a valid certificate before entering credentials. Use a VPN on public or untrusted WiFi. Modern browsers display clear warnings when certificate validation fails — don't click through them. Enable HSTS preloading awareness: your browser will refuse to load important sites over HTTP even if tricked into trying.

7. Shoulder surfing and physical observation

Someone watching you type in a café, on public transit, or even from a window can capture your password. This is embarrassingly simple and effective — especially for PINs and short passwords typed repeatedly on the same device. Shoulder surfing accounts for a surprising proportion of corporate data breaches in open-plan offices.

Defence: Be physically aware of surroundings when typing sensitive credentials. Use a privacy screen on laptops in public. On mobile devices, use biometric authentication (fingerprint, Face ID) instead of typed PINs in public — biometrics don't reveal themselves to an observer.

What doesn't protect you: common myths

Your complete defence checklist