Lessons · Cybersecurity · passwords: length over complexity
Passwords: length beats cleverness
A password's strength is how many guesses it would take to find it, and every extra character multiplies that number, while swapping a letter for a symbol barely moves it.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The policy said eight characters with a capital, a number and a symbol, so everybody picked Summer24 and its cousins. A guessing program tries the common shapes first and had a third of the accounts by teatime. Sixteen plain lower-case letters would have held for years.
How to think about it
Count the guesses. Strength in bits is length times log2 of the alphabet size, and each bit doubles the number of guesses. Then compare a long passphrase from a small alphabet against a short password from a big one, and watch the long one win.
Worked example
bits = length * log2(alphabet size)One line. The alphabet size is how many different characters could sit in each position.
8 characters from 95 printable: 8 * 6.57 = 52.6 bitsThe complex password. log2(95) is about 6.57 bits per character.
16 lower-case letters: 16 * 4.70 = 75.2 bitsThe plain passphrase. log2(26) is about 4.70. Twenty-two bits more is about four million times more guesses.
Policy: at least 14 characters, no forced symbols, checked against leaked listsWhat the arithmetic says the rule should be.
Your turn
A 20-character password from an alphabet of 16 characters. Write the line that gives its strength in bits.
bits = 20 *
Solve one, graded on the server
The trap
Forcing a change every 90 days. People add a digit and count upward, attackers know it, and the only real change is how many passwords end up on sticky notes.