online vs offline password attacks, know the difference

not all password attacks work the same way

if you've spent any time around security content, you've seen hydra, hashcat, john the ripper, and "password spraying" all mentioned like they're interchangeable tools in the same toolbox. they're not. they solve different problems, they leave different footprints, and understanding the difference is actually the key to defending against all of them. so let's break down what's actually happening, from a defender's seat.

online attacks: hydra and the noisy front door

an online attack means the attacker is guessing passwords against a live, running service, your ssh port, your web login form, your rdp, whatever. tools like hydra work by literally sending login attempt after login attempt to that service and watching what comes back.

this is slow. every guess has to travel over the network, wait for the service to respond, and get evaluated. it's also loud. every single attempt is a login event that your server, your firewall, your auth logs, all see happening in real time.

as a defender, this is the good news category. online attacks are the easiest to catch and the easiest to stop, because the attacker has to interact with your live system to make any progress at all. rate limiting, account lockouts, fail2ban style tools, and just watching your auth logs for repeated failures from one source will shut this down fast.

offline attacks: hashcat, john, and why speed changes everything

offline attacks are a different animal entirely. instead of guessing against a live service, the attacker already has something, usually a password hash, that they pulled from a breached database, a stolen file, a memory dump, wherever. now there's no server to talk to and no rate limit to respect. they just run guesses against that hash on their own hardware, as fast as their gpu can go.

this is where hashcat and john the ripper live. these tools aren't attacking your service, they're attacking math. they take a wordlist or a set of rules, hash each candidate password the same way your system did, and compare it to the stolen hash. a modern gpu can try billions of guesses a second against a weak hash type. that's not a typo. billions.

the defender's lesson here isn't "block the traffic," because there is no traffic to block. it already happened, probably during a breach you may not even know about yet. the defense has to happen before the theft: strong hashing algorithms on your end (bcrypt, argon2, scrypt, not fast general purpose hashes like plain md5 or sha1), and strong, unique, long passwords or passphrases on the user's end so that even at billions of guesses a second, cracking your specific password takes longer than the attacker's patience or hardware budget.

password spraying: quiet, patient, and lockout-aware

spraying flips the usual brute force logic. instead of throwing thousands of passwords at one account, an attacker throws one or two common passwords (think "summer2024!" or "companyname123") across hundreds or thousands of accounts. one guess per account, then wait, then maybe try again later.

why bother? because most lockout policies are built to stop someone hammering a single account with guesses. spraying dodges that entirely by staying under the threshold on every individual account while still getting a statistically decent hit rate, because someone, somewhere, always reused a weak seasonal password.

this is why lockout policies alone are not a complete defense. you need to also be watching for the pattern across accounts, not just within one.

why "capture the hash and crack offline" matters to you

the caption line "capture the hash and crack offline whenever you can" is really describing attacker efficiency, but flip it around and it's a map of exactly where your organization's exposure lives. if your hashes ever leak, whether from a breach, a misconfigured backup, or an exposed database, the fight moves offline into hashcat and john territory instantly, and there's nothing your login page's rate limiting can do about it anymore. the entire game becomes about hash algorithm strength and password strength, full stop.

the takeaway

protect the online front door with lockouts, rate limiting, mfa, and log monitoring for both single-account hammering and low-and-slow spraying across your user base. but don't stop there. assume your hashes could leak someday and make sure they're stored with a slow, modern algorithm like bcrypt or argon2, not something a gpu chews through for breakfast. pair that with long unique passphrases or a password manager, and turn on mfa everywhere you can. the goal isn't to make cracking impossible, it's to make it take longer than anyone's willing to wait.