Every password advice poster you have ever seen is optimising the wrong
variable. Here is the arithmetic, a calculator to try it on, and the place where the
arithmetic quietly stops being true.
The needle is not the point. The haystack is.
An attacker who has your password hash and no other information has one option:
try every possible password in order until one matches. How long that takes depends
on two numbers, and only two.
The first is the alphabet — how many different characters you might
have used. Lowercase only is 26. Add uppercase and it is 52. Add digits, 62. Add the
symbols on a US keyboard and it is 95, which is as wide as it gets.
The second is length. And this is where the intuition breaks, because the
two numbers do not carry equal weight. The alphabet is the base. The length
is the exponent. Widening the alphabet from 26 to 95 multiplies your search
space by about 3.7 for a fixed length. Adding a single character multiplies it by the
entire alphabet — 26 at worst, 95 at best. Adding ten characters multiplies it
ten times over.
So P@ssw0rd! is nine characters over the full 95-character alphabet:
roughly 1017 possibilities. And mountainbicyclelamp is
nineteen characters over the meagre 26-character lowercase alphabet: roughly
1026. The boring one is about a billion times harder to brute-force,
and it is easier to type and easier to remember.
Try it
This runs entirely in your browser. Nothing you type is sent anywhere, stored,
or logged — there is no form here to submit. All the same, if you are about to
type the password you actually use, change one character first. Good habit.
a–z +26A–Z +260–9 +10symbols +33
Length9
Alphabet95
Search space–
Online attack1,000 guesses/sec–
Offline fast attack100 billion guesses/sec–
Massive cracking array100 trillion guesses/sec–
Padding: length you do not have to remember
If length is what matters, the cheapest way to get it is to repeat something. Take
a short password you already know and pad it with a run of one character:
Password
Length
Alphabet
Massive array
The pad does not have to be dots. Any character you can hold a key down for works,
and because it is one repeated character you are remembering three characters and a
habit, not twenty-four characters.
Where this stops being true
The arithmetic assumes the attacker is guessing blind
Every number on this page counts every combination in order. That is what
an attacker does when they have exhausted every better idea — and they have a
great many better ideas.
Real cracking starts with wordlists: dictionaries, every password ever exposed in a
breach, names, dates, sports teams, and rules that mangle them the way people do
— capitalise the first letter, put a number and a bang on the end, swap
o for 0. P@ssw0rd! does not take
1017 guesses. It takes about one, because it is in every list ever
compiled. correcthorsebatterystaple is twenty-five characters and also
falls instantly, because a comic made it famous and the wordlists caught up.
So length is necessary and not sufficient. The search space is the floor on
how long you last — the best case, and only if nothing about your password is
guessable. Anything a human would think of, another human already has.
What to actually do
Length first, always
Given a choice between one more character class
and four more characters, take the characters. It is not close.
Unique per site, no exceptions
Reuse defeats all of this. One breach
somewhere careless hands an attacker the password to somewhere that is not.
Let software remember them
A password manager generates long random
strings and remembers them for you, which removes the only real argument against
long random strings.
Turn on a second factor
Multi-factor authentication makes a stolen
password insufficient on its own. It is the single highest-value thing on this
list.
Passphrases, but unpredictable ones
Four words chosen at random by
software are strong. Four words chosen by you are a sentence, and sentences are
guessable.
Pad the ones you must type
For the handful you type by hand —
your device login, your manager's own master password — padding buys real
length for almost no memory.
Now go and lose to it.Ten rounds against the clock on which password holds out longer, then build one
yourself in sixteen keystrokes.
Where this comes from. The haystack framing and the three
attack speeds were popularised by Steve Gibson's
Password Haystacks
page at GRC, which is worth reading in full. The underlying arithmetic is just
combinatorics and belongs to nobody. The calculator, the worked examples and the wording
on this page are our own, and the section above about wordlists is the part we would add
to any version of it. Search space is counted exhaustively — every password up to
that length — and divided by the guess rate, so the times shown are the worst case
for the attacker. On average they would find it in half.
