This is a list of password strengths, based on generated passwords of various lengths, using different alphabets.
- The 'alphabet' is what we call the available characters we can use to write our password.
- The 'length' is the number of those characters we are going to use to create our password.
- The 'entropy' is the measure of how much randomness we have. High entropy = good. Low entropy = bad.
- The
**symbol represents 'raised to the power of' as a mathematical expression.
A generated password is only secure if was generated using a PRNG (Pseudo-Random Number Generator). Mashing the keyboard achieves nowhere near the same level of entropy in a password, and thus, is nowhere near as secure.
- Generated password using PRNG == High entropy.
- Password generated using any other method == Entropy not high enough.
The remainder of this article explicitly describes the strength of passwords that are generated using a PRNG.
alphabet=3 len=1 3^1 = 3 combinations.
alphabet=1 len=3 1^3 = 1 combination.
alphabet=2 len=3 2^3 = 8 combinations.
There are 16 characters in the Hexadecimal alphabet. There are 26 characters in the a-z alphabet. There are 62 characters in the a-zA-Z0-9 alphabet. There are 64 characters in the Base64 alphabet. There are 94 printable ASCII characters in the lower ascii alphabet.
62**8 = 218,340,105,584,896 combinations
94**8 = 6,095,689,385,410,816 combinations
62**9 = 13,537,086,546,263,552 combinations
62**14 = 12401769434657526912139264 // "DXzOx4B3nSfSoK"
62**15 = 768909704948766668552634368 // "DXzOx4B3nSfSoK6"
94**14 = 4205231901698742834534301696 // "H;ie")A|p%,$tk"
62**16 = 47672401706823533450263330816 // "DXzOx4B3nSfSoK6C"
So we actually only need to add two or three more characters to our a-zA-Z0-9 password to make it stronger
than a randomly generated password that uses the 94 printable characters in the lower ascii range.
For an 8 character random password using a-zA-Z0-9 alphabet, we are looking at 218 Trillion combinations.
1000 attempts/sec would take 218340105584 seconds, or 6923 years to guess all the combinations.
if could could compute 1 million hashes per second (you'd need a BotNet or compute cluster to achieve this), t would still take you nearly 7 years to guess all the combinations, and half of that time again to have just a 50% probability of generating the correct one.
That's an 8 character randomly generated password using a-zA-Z0-9 only.
What happens when we increase that to 16 characters?
62**16 = 47,672,401,706,823,533,450,263,330,816 combinations.
at 1 million attempts per second, it will take us 47,672,401,706,823,533,450,263 seconds to guess them all.
The universe is 13.772 Billion years old. That's 13,772,000,000 years. That's 434,313,792,000,000,000 seconds.
According to "The World’s Technological Capacity to Store, Communicate, and Compute Information.” by Martin Hilbert and Priscila López. Science, 692-693, Feb. 11, 2011 The current (as of 2011) estimated processing power of all devices on the planet are capable of processing 6.4e18 computational operations per second. // @see https://www.wired.com/2011/02/world-computer-data/ // @see http://dx.doi.org/10.1126/science.1200970
That's 6,400,000,000,000,000,000 operations per second.
If we were to assume that it took 1000 "operations" to calculate a single 16-character a-zA-Z0-9 alphabet password hash (which is way below what it actually takes)
Then that's 6,400,000,000,000,000 hash break attempts per second, by consuming the entirety of the worlds processing power.
So taking our 62**16 password hash, and pitting it against the processing power of "The Earth", we would be able to calculate all possible password combinations in.... drumroll
236 Thousand years. (as of 2011) (Not taking into account Moore's Law)
So, when using a 26 character alphabet, a 14 character password is marginally stronger than an 11 character password that uses the a-zA-Z0-9 range, and that is approximately the same strength as a 10 character password using the full lower-ascii range of printable characters.
26**14 = 64509974703297150976
62**11 = 52036560683837093888
94**10 = 53861511409489970176
If you want a longer password than that, a 20 character a-z password is approximately the same strength as:
26**19 = 766467265200361890474622976 // "krmvjbvvdhzjbszodib" <-- 19 char a-z
62**15 = 768909704948766668552634368 // "9WdxxeMPVirwgVA" <-- 15 char a-zA-Z0-9
94**14 = 4205231901698742834534301696 // "^/W/*8SmzReyks" <-- 14 char a-zA-Z0-9 + special chars
26**20 = 19928148895209409152340197376 // "krmvjbvvdhzjbszodibf" <-- 20 char a-z
62**16 = 47672401706823533450263330816 // "9WdxxeMPVirwgVAw" <-- 16 char a-zA-Z0-9
94**15 = 395291798759681826446224359424 // "^/W/*8SmzReyks6" <-- 15 char a-zA-Z0-9 + special chars
26**21 = 518131871275444637960845131776 // "krmvjbvvdhzjbszodibfx" <-- 21 char a-z
The above calculations ONLY apply to randomly generated passwords. If you have "mash the keyboard" or otherwise tried to invent your own memorable way creating passwords by hand, then it isn't secure, and the above calculations won't take that lack of entropy into account.
Requiring passwords to contain special characters is advice that is ONLY applicable to passwords that you need to type in by hand. If you can copy and paste it, then you don't need special characters. Maximum password length is far more important than the alphabet you're generating it from.