Is it true that a password consisting of the alphabet, even of common known names is much harder to find for a computer program than a short password, even though it uses numbers and other characters?


  • $\begingroup$ Yes. The math in the comic is correct. $\endgroup$ – Aaron Sep 26 '14 at 22:44
  • 10
    $\begingroup$ Already answered on Information Security SE. $\endgroup$ – David Richerby Sep 26 '14 at 22:53
  • $\begingroup$ Depends on the algorithm. The comic seems to assume guessing strings character-wise; if it uses a dictionary attack and builds passwords word-wise, the second one only offers four bits (on an alphabet with several thousand elements, of course). $\endgroup$ – Raphael Sep 27 '14 at 6:43
  • $\begingroup$ @Raphael Well, if someone ask you to crack any password would you assume that the password is consisted of dictionary words.... What if there's a french word in it... What if just one word is misspelled?? $\endgroup$ – The Mean Square Sep 27 '14 at 7:09
  • 1
    $\begingroup$ I must say I disagree that this question is off-topic here. That being said, it has had an excellent answer on Information Security (as well as a bad answer which still outscores it, dammit), and I very much doubt we can do any better. $\endgroup$ – Gilles 'SO- stop being evil' Sep 27 '14 at 18:16

Usually when we talk about "hard to find" we are talking about brute force guessing. This is where the attacker just keeps trying different passwords till they find the right one. I'm going to assume we're talking about this model here and not talk about the real world with hashing and rainbow tables and so forth.

Now, there is nothing inherently different about trying a 5-character random string versus trying a 4-word password. They are both equally easy for a computer to plug in and see if they work. Instead, the question is how many guesses you need to find the password, i.e. how hard is it for an attacker to guess your password.

Now, an important question is what the attacker knows about your strategy of picking passwords. We usually want to make the worst-case assumption that the attacker knows our method for picking passwords. Under this key assumption, we can compare the two methods.

If we pick a 5-character password uniformly at random from all strings containing a-z,A-Z,0-9,!@#\$%^&*()-_+={}[];:'"|\,<.>/? then we have something like $92^5 \approx 6.6$ billion possibilities. So the attacker has a one in $6.6$ billion chance of guessing it on the first try, and so on.

If we pick 4 random words uniformly from a set of say 500 words, then we have $500^4 = 62.5$ billion possibilities. So in this example, the attacker is worse off trying to guess a 4-word random passphrase than a 5-character random string. Notice that the example is really assuming that we do this random process for picking passwords, i.e. we run a computer program that takes a list of 500 words and (using good randomness!) spits out a sequence of 4 random words.

Also notice that both of these examples assumed that the attacker knows your strategy. If the attacker is first going to try all 4-word passphrases, and then all 5-character strings, then you would rather have a short random string because it will take longer for that attacker to guess. But since you don't know what the attacker knows, you're best off assuming they know what type of passwords you use, but they don't know which one you picked. And by "type" of password, I really mean a method of generating that password, like uniformly random 5-character strings. Thinking about this method, as we did above, tells you how random or hard-to-guess it is.