- Most web browsers on computers, phones, and tablets automatically save logins and passwords so people don't have to remember them.
- If you enter the wrong password too many times when trying to log in, you'll usually be locked out of the account.
- You can use password cracking tools and keyloggers on your own devices, but it's not legal (or ethical) to crack or record other peoples' passwords.
Check the Web Browser on a Computer
Many web browsers automatically save the passwords we use to access websites. If the password you're looking for was saved by the web browser, you may be able to find it in plain text. In most cases, you'll need to enter the primary password you use to access your PC or Mac to view passwords in the password manager. Google Chrome: Click the three dots at the top-right and select Settings. Click Autofill at the top-left. Click Password Manager in the main panel. Click the eyeball next to a saved password to view it. Safari: Click the Safari menu and choose Preferences. Click Passwords Select a website and click Edit to view the password. Microsoft Edge: Click the three dots at the top-right and select Settings. Click Passwords in the right panel. Click the eyeball next to a saved password. Firefox: Click the three-line menu at the top-right and select Settings. Click Privacy & Security in the left panel. Scroll down and click Saved Logins… in the right panel. Select a login from the left panel, then click the eyeball on the right to view it.
View all Android, iPhone, or iPad Passwords
If you (or the person who uses the password) entered the password on a phone or tablet, it may be saved in Keychain or Google Passwords. Just like with web browsers on a computer, most phones and tablets automatically save login and passwords so people won't have so many passwords to remember. If you have access to a phone or tablet, you might be able to see all stored passwords in plain text—although, you'll usually need to enter the phone's PIN or biometric to view these passwords. iPhone/iPad: Try Siri first. With the screen unlocked, say, "Hey Siri, show me my passwords," or "Siri, what's the password for my Netflix account?" Open the Settings app and select Passwords. Enter your PIN or biometric. Select a website or app to view the password. Android: Open Chrome and tap the three dots at the top-right. Tap Settings and select Passwords. Tap a password, then tap Show password or the eyeball icon.
Search for Files that Contain Passwords
Search for stored passwords on the account holder's computer. Some people store their passwords plain text files on their computers, which is definitely not a secure way to store passwords. If you (or the person whose password you're trying to find) have such a file, you can try searching for files that contain the word "password" or the username you're trying to access. On Windows: First, you'll need to enable a feature that allows you to search for certain text within documents. Press Windows key + S and type index. Click Indexing Options. Click Advanced and select the File Types tab. Select Index Properties and File Contents, click OK, then click Close. Now, open File Explorer, click This PC, and type "password" (or the username or site you're trying to access) into the search bar at the top-right. All files containing the word "password" anywhere in the text will appear. On a Mac: Open Finder. Press Command + F to open Find. Select "Kind" from the first drop-down menu, then select "Text" from the second. Type "password" (or the username or site you're trying to access) into the field at the top-right, and all files containing the word you entered will appear.
Look for Passwords on Paper
Some people write down their passwords so they won't forget them. Whether you're looking for somebody else's password or your own, check the area near the computer for sticky notes containing login information, notebooks with password lists, or any scraps of paper that might have this information. Some people even buy "password journals," which are entire notebooks geared toward listing your passwords in an easy-to-remember format. While this is not a secure way to store your passwords, it's very common.
Click the "Forgot Password" Link
If you're trying to access a website or app, look for a "Forgot Password" link on the login screen. This option is typically somewhere near the username and password fields. Clicking this link will typically give you the option to receive a password reset link via email, text message (SMS), or by answering security questions. In most cases, you'll need to have access to the email account or phone number associated with the account. So, it's best to only use this method for your own accounts. If security questions are available, you may be able to answer them immediately to reset the password. But in most cases, the answering the security questions will typically send a password reset link to the email address on file to complete the password reset form.
Guess the Password
If you know the password requirements of the site or service you want to access, you might be able to guess the password. This can be a little risky, as too many guesses may lock you out of the account. Before you start guessing, figure out the minimum password requirements for the site or service, such as how many characters are required, and whether there needs to be a mix of upper- and lower-case letters, numbers, and symbols. This can help you narrow down the options. Our handy guide to guessing passwords will be very helpful if you're not sure where to start! If you want to access a phone, like an iPhone or Android, the password or PIN will usually be easier to guess as it'll be fewer characters and (almost always) just numbers. People often use digits from their own phone numbers, social security numbers, birthdates, and other significant numbers as their phone PINs. People often use the names of their pets, partners, or other significant people in their lives in their passwords—you can try these names, along with any numbers you think are important to that person. For example, a pet's name followed by the year of birth.
Use a Password Cracker
Password cracking tools can crack passwords on Linux, Windows, or macOS. These tools are for advanced users who have access to the hash or shadowed version of the password—you won't be able to use password crackers to try a bunch of logins on a website. Cracking tools work by brute force (basically, trying all characters from a character set), dictionary attacks (using word lists), or a combination of multiple cracking methods. John the Ripper, one of the most famous password cracking tools, comes preinstalled in Kali Linux. If you want to use it on another platform, you can download it from https://www.openwall.com/john. Speaking of Kali Linux, Wfuzz is a cracking tool that uses brute force methods to crack web-based passwords. It comes pre-installed on Kali, but you can also download the source code for other flavors of Linux. Hashcat, known as "The World's Fastest Password Cracker," is a command-line app that runs on Windows, macOS, and Linux. To crack a Windows user password, you can use Hash Suite, which is a port of John the Ripper. Mimikatz is another Windows password-cracking tool that can extract plain text passwords, hashed passwords, PIN codes, and Kerberos tickets from memory.
Install a Keylogger
Keyloggers are programs or devices that capture every keystroke a person types. When installed properly, most users won't know they're being recorded. The thing is, it's not legal to install a keylogger on another person's computer or phone unless you have permission to do so—you should only do this on your own devices, or with permission. For example, it's legal for an IT department to install a keylogger on a user's computer to monitor workplace activity if the employee consented during the hiring process. It's also legal to install a keylogger on your own computer, which can be helpful if you're trying to find your child's passwords. Some keyloggers are hardware-based, but those are less common. Legitimate software-based keyloggers are usually marketed to businesses and parents—some popular options are WebWatcher, Kidlogger, Revealer, Spyrix, and StupidKeyLogger. Before downloading software to your computer, make sure the website is not a scam.
Comments
0 comment