Eli5:how does hackers get password from hashes?

Question

As far as I can see it’s just random text, how can they get password from this after a website is hacked?

In: 2

Answer 1

You can’t go backwards from a hash to a password, so instead you calculate the hashes for LOTS of passwords and compare them until one matches.

Eg. All I know is that the sum of an unknown quantity of single digit numbers equals 39. I can’t go backwards from 39 to find those numbers, so instead I do this;

1+1=2 no match

1+2=3 no match

1+3=4 no match

…

9+9+1=19 no match

…

9+9+9+9+3= 39 match! Password cracked

Note that something like 5+5+5+5+5+5+5+4 also equals 39. In hashing this is called a collision, it is VERY rare but it actually doesn’t matter to an attacker, both passwords will work as long as the hash is the same.

There are ways to do this other than brute force as shown above, but the process is the same. Calculating LOTS of hashes and comparing them until hopefully you find a match.