How password haystacks work

The needle is not the point. The haystack is.

An attacker who has your password hash and no other information has one option: try every possible password in order until one matches. How long that takes depends on two numbers, and only two.

The first is the alphabet — how many different characters you might have used. Lowercase only is 26. Add uppercase and it is 52. Add digits, 62. Add the symbols on a US keyboard and it is 95, which is as wide as it gets.

The second is length. And this is where the intuition breaks, because the two numbers do not carry equal weight. The alphabet is the base. The length is the exponent. Widening the alphabet from 26 to 95 multiplies your search space by about 3.7 for a fixed length. Adding a single character multiplies it by the entire alphabet — 26 at worst, 95 at best. Adding ten characters multiplies it ten times over.

So P@ssw0rd! is nine characters over the full 95-character alphabet: roughly 10¹⁷ possibilities. And mountainbicyclelamp is nineteen characters over the meagre 26-character lowercase alphabet: roughly 10²⁶. The boring one is about a billion times harder to brute-force, and it is easier to type and easier to remember.

Try it

Type a password — or something like one

This runs entirely in your browser. Nothing you type is sent anywhere, stored, or logged — there is no form here to submit. All the same, if you are about to type the password you actually use, change one character first. Good habit.

a–z +26 A–Z +26 0–9 +10 symbols +33

Length9

Alphabet95

Search space–

Online attack 1,000 guesses/sec–

Offline fast attack 100 billion guesses/sec–

Massive cracking array 100 trillion guesses/sec–

Padding: length you do not have to remember

If length is what matters, the cheapest way to get it is to repeat something. Take a short password you already know and pad it with a run of one character:

Password	Length	Alphabet	Massive array

The pad does not have to be dots. Any character you can hold a key down for works, and because it is one repeated character you are remembering three characters and a habit, not twenty-four characters.

Where this stops being true

The arithmetic assumes the attacker is guessing blind

Every number on this page counts every combination in order. That is what an attacker does when they have exhausted every better idea — and they have a great many better ideas.

Real cracking starts with wordlists: dictionaries, every password ever exposed in a breach, names, dates, sports teams, and rules that mangle them the way people do — capitalise the first letter, put a number and a bang on the end, swap o for 0. P@ssw0rd! does not take 10¹⁷ guesses. It takes about one, because it is in every list ever compiled. correcthorsebatterystaple is twenty-five characters and also falls instantly, because a comic made it famous and the wordlists caught up.

So length is necessary and not sufficient. The search space is the floor on how long you last — the best case, and only if nothing about your password is guessable. Anything a human would think of, another human already has.

What to actually do

Length first, always

Given a choice between one more character class and four more characters, take the characters. It is not close.

Unique per site, no exceptions

Reuse defeats all of this. One breach somewhere careless hands an attacker the password to somewhere that is not.

Let software remember them

A password manager generates long random strings and remembers them for you, which removes the only real argument against long random strings.

Turn on a second factor

Multi-factor authentication makes a stolen password insufficient on its own. It is the single highest-value thing on this list.

Passphrases, but unpredictable ones

Four words chosen at random by software are strong. Four words chosen by you are a sentence, and sentences are guessable.

Pad the ones you must type

For the handful you type by hand — your device login, your manager's own master password — padding buys real length for almost no memory.

Find your exam