thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Home › Student Rec Center › Security Fundamentals › Needle in a Haystack

Needle in a Haystack — ten rounds on why password length beats complexity, then build one yourself.

Round–
Score0
Streak0
Best0

thinQtank arcade · security fundamentals

NEEDLE IN A HAYSTACK

A rented rack of GPUs can try 100,000,000,000,000 guesses a second. Against that, one thing about a password really matters — and it is almost certainly not the thing you were taught. Two passwords a round, ten seconds on the clock, pick the one that holds out longer.

Online guessing1 thousand/s
Offline fast100 billion/s
Massive array100 trillion/s

Sound on · press S to mute

How haystacks work
thinQtankPOWERTRAINING MONITOR
NEEDLE IN A HAYSTACK
POWERVIDEOAUDIO
Needle in a HaystackthinQtank arcade

Learn more about the password haystack →

How the numbers are worked out. Search space is every possible password up to that length over the character sets it uses — the same exhaustive count Steve Gibson's search space calculator popularized. Time is that count divided by the attacker's guess rate, so it is the worst case for the attacker and the best case for you: on average they would find it in half that. The arithmetic here is exact, done in whole numbers rather than floating point, and it was checked against an independent implementation before this page went up.