# Is a very long plain text password harder to crack than a short complicated password? [closed]

Is it true that a password consisting of the alphabet, even of common known names is much harder to find for a computer program than a short password, even though it uses numbers and other characters?

• Yes. The math in the comic is correct. – Aaron Sep 26 '14 at 22:44
• Already answered on Information Security SE. – David Richerby Sep 26 '14 at 22:53
• Depends on the algorithm. The comic seems to assume guessing strings character-wise; if it uses a dictionary attack and builds passwords word-wise, the second one only offers four bits (on an alphabet with several thousand elements, of course). – Raphael Sep 27 '14 at 6:43
• @Raphael Well, if someone ask you to crack any password would you assume that the password is consisted of dictionary words.... What if there's a french word in it... What if just one word is misspelled?? – The Mean Square Sep 27 '14 at 7:09
• I must say I disagree that this question is off-topic here. That being said, it has had an excellent answer on Information Security (as well as a bad answer which still outscores it, dammit), and I very much doubt we can do any better. – Gilles 'SO- stop being evil' Sep 27 '14 at 18:16

If we pick a 5-character password uniformly at random from all strings containing a-z,A-Z,0-9,!@#\$%^&*()-_+={}[];:'"|\,<.>/? then we have something like$92^5 \approx 6.6$billion possibilities. So the attacker has a one in$6.6$billion chance of guessing it on the first try, and so on. If we pick 4 random words uniformly from a set of say 500 words, then we have$500^4 = 62.5\$ billion possibilities. So in this example, the attacker is worse off trying to guess a 4-word random passphrase than a 5-character random string. Notice that the example is really assuming that we do this random process for picking passwords, i.e. we run a computer program that takes a list of 500 words and (using good randomness!) spits out a sequence of 4 random words.