---
title: "Password audits"
url: "https://unshade.pl/en/services/password-audits"
lang: "en"
summary: "Credential analysis: complexity, reuse and presence in breach databases."
---

# Password audits

We test your organisation's passwords the way an attacker would after a hash leak — and show which policies work and which exist only on paper.

## Scope

- Cracking Active Directory hashes
- Shared and reused passwords
- Presence in public breaches
- Compliance with the password policy
- Privileged and service accounts

## What you get

- Statistics without revealing passwords
- List of accounts that need a change
- Password policy recommendations
- Material for staff training

## What a password audit is

A comprehensive assessment of credential security in your organisation. We focus on the weak points of passwords: low complexity, reuse and presence in breach databases. It is an essential service for organisations managing large numbers of accounts, where both efficiency and security matter.

## Our own hardware, full confidentiality

We run audits with our own tooling and dedicated cracking rigs built on Nvidia RTX graphics cards. Dedicated hardware gives performance, cost efficiency and full confidentiality — no cloud involved. We work on hashes, not plaintext, and the report contains statistics and account identifiers, never recovered passwords.

## What you gain

- **Better IT security** — identifying weak and compromised passwords removes easy targets for cybercriminals.
- **Better access management** — we find unused accounts and tidy up access to systems.
- **An effective password policy** — rules that enforce strong, unique passwords and raise resilience to attacks.
- **More aware employees** — knowledge about password security changes daily habits.
- **Regulatory compliance** — readiness for standards and regulations such as NIS2 and GDPR.
- **Cost optimisation** — fast identification of threats instead of costly incidents.

## How to strengthen password protection

- **An effective password policy** — consistent, secure standards across the company.
- **Security level assessment** — whether the passwords in use are strong enough and attack-resistant.
- **Removing weak points** — dictionary, leaked and low-complexity passwords.
- **Eliminating reuse** — accounts that share the same credentials.

## Report and re-audit

The report includes an executive summary, a description of the methodology and attacks performed, and detailed results: patterns found, statistics of cracked passwords and recommendations for the security policy. Regular audits let you measure progress and react to a changing environment.

## What our clients say

> Working with Unshade guarantees professionalism and the highest standards. The team's flexibility, discretion and commitment were outstanding. I highly recommend Unshade as a reliable partner.
> — Marcin Marczewski, CEO, Resilia

> Unshade are experts you can rely on. Their knowledge, precision and dedication allowed us to ensure the highest level of security for our client's systems. I recommend their services to anyone looking for a solid partner in penetration testing.
> — Michał Mikołajczak, CEO, DataRabbit

> Unshade is a reliable and professional partner that conducted penetration tests and IT security workshops for us at the highest level. The team's expert knowledge and meticulousness resulted in a real strengthening of our systems' security. We fully recommend their services.
> — Piotr Goździejewski, Head of DevSecOps, e-file

## Blog

- [120 minutes that can save your company – a cybersecurity awareness training](https://unshade.pl/en/blog/120-minutes-that-can-save-your-company.md)
- [PBKDF i bcrypt](https://unshade.pl/en/blog/pbkdf-and-bcrypt.md)
- [How to Bypass AMSI? My Experience with PowerShell Bypassing](https://unshade.pl/en/blog/how-to-bypass-amsi.md)
- [Bcrypt Cocktail and Hash Extraction](https://unshade.pl/en/blog/bcrypt-cocktail-and-hash-extraction.md)
- [Sacrificial session](https://unshade.pl/en/blog/sacrificial-session.md)
- [Hash function](https://unshade.pl/en/blog/hash-function.md)
- [Introduction to Password Cracking #3 Rules](https://unshade.pl/en/blog/introduction-to-password-cracking-3-rules.md)
- [Introduction to Password Cracking #1 Intro](https://unshade.pl/en/blog/introduction-to-password-cracking-1-intro.md)
- [Introduction to Password Cracking #2 Wordlists](https://unshade.pl/en/blog/introduction-to-password-cracking-2-wordlists.md)
- [CrackMeIFYouCan 2022 DEFCON Writeup](https://unshade.pl/en/blog/crackmeifyoucan-2022-defcon-writeup.md)

## Request an anonymised report

See what our penetration test report looks like: the structure, findings with PoC, CVSS ratings and recommendations. We send an anonymised version to your work email.