Needle in a Haystack — ten rounds on why password length beats
complexity, then build one yourself.
Round–
Score0
Streak0
Best0
thinQtank arcade · security fundamentals
NEEDLE IN A HAYSTACK
A rented rack of GPUs can try 100,000,000,000,000
guesses a second. Against that, one thing about a password really matters —
and it is almost certainly not the thing you were taught. Two passwords a round,
ten seconds on the clock, pick the one that holds out longer.
Each extra character multiplies the search
space by the whole alphabet. Each extra character class only widens the
base. Nineteen lowercase letters beat nine mixed characters by about a billion
to one.
Padding is free length
A short password you can remember, then a
run of one repeated character, is a long password. D0g plus twenty-one full
stops outlasts the age of the universe at a hundred trillion guesses a
second.
The math assumes ignorance
All of it assumes the attacker tries
every combination in order. Real ones start with wordlists, so anything
recognizable falls in seconds however long it is. Length protects you only when
the rest is unguessable.
How the numbers are worked out. Search space is every possible
password up to that length over the character sets it uses — the same exhaustive
count Steve Gibson's search space calculator popularized. Time is that count divided by
the attacker's guess rate, so it is the worst case for the attacker and the best case for
you: on average they would find it in half that. The arithmetic here is exact, done in
whole numbers rather than floating point, and it was checked against an independent
implementation before this page went up.
