Some of the strongest and easy to remember passwords are just a few words strung together with a few numbers.
For example: Simpsons7-Purple4-Monkey1-Dishwasher8
Just remember “Simpsons Purple Monkey Dishwasher” and “7418”. You’re probably never going to forget that and I just tossed it into a password strength tester and it said it would take about 46 billion years to randomly guess it.
Now remember these types of passwords, all different for different services. It’s not a realistic expectation. Password managers are a must nowadays if you want to protect your accounts. But these types of passwords are also easier to type out.
Password strength checkers are taking an approach that’s naive for this case. The actual strength depends on the size of the dictionary and the number of words you randomly choose out of it.
Bcrypt has a length limit of 72 characters, so very long passwords generated this way can be silently truncated. Developers can avoid this problem by running sha256 on the input before giving it to bcrypt, but that isn’t common.
If the structure of it is known it becomes much faster. Word+single digit^4 isn’t all that hard.
For the vast majority of purposes, it’ll be fine. And certainly as long as that particular structure isn’t commonplace, it won’t be easy to guess anyway. But password strength testers don’t consider that - guessing “aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa” randomly also takes billions of years, so they can give a bit of a sense of false security.
The fastest super computer at the moment apparently sits at 1.1 quintillion Hz. Or 1.1 billion billion.
If that computer could make 1 guess every clock cycle it would still take it over 4 years (167957820891293697014400000 / 1.1quintillion = ~52 months ) to run through all possibilities.
Now that is a very fast computer, and we haven’t included the possibility of various numbers of words, different delimiter, or where and how often numbers appear. So unless you’ve really pissed off the US gov I don’t think you have to worry about it.
There’s a reason passphrases are the currently recommended way to generate secure passwords that are hard to guess but easy to memorize/type in.
I also tweak my base password based on the site. One site hack could lead to all your passwords being compromised no matter how long it is. Sure someone might be able to figure out the pattern if they analyzed it manually, but most hacks try to break into accounts en masse and they’re not going through passwords one by one.
Some of the strongest and easy to remember passwords are just a few words strung together with a few numbers.
For example: Simpsons7-Purple4-Monkey1-Dishwasher8
Just remember “Simpsons Purple Monkey Dishwasher” and “7418”. You’re probably never going to forget that and I just tossed it into a password strength tester and it said it would take about 46 billion years to randomly guess it.
It would take me about 5 seconds because you just told me what it is genius
Now remember these types of passwords, all different for different services. It’s not a realistic expectation. Password managers are a must nowadays if you want to protect your accounts. But these types of passwords are also easier to type out.
My tactic is use a memorizeable passphrase as the unlock for the vault and assorted gibberish for anything in the vault
Correct horse battery staple
Anything else and I can’t remember so I’m using this.
I’m told it’s very secure so I must be very secure. Right? Right?
How about hunter2
Yeah, a bunch of asterisks works too.
Password strength checkers are taking an approach that’s naive for this case. The actual strength depends on the size of the dictionary and the number of words you randomly choose out of it.
Bcrypt has a length limit of 72 characters, so very long passwords generated this way can be silently truncated. Developers can avoid this problem by running sha256 on the input before giving it to bcrypt, but that isn’t common.
I’ll never understand why spaces are commonly not allowed in passwords.
I’ve seen stupid developers do dumb stuff that makes keyboard remove and or add spaces to password fields. Making you type correctly but still fail.
Same with tabs.
Or you could just use a password manager
For maximum security your password manager should have a password and you have no choice but to remember that password.
If the structure of it is known it becomes much faster. Word+single digit^4 isn’t all that hard.
For the vast majority of purposes, it’ll be fine. And certainly as long as that particular structure isn’t commonplace, it won’t be easy to guess anyway. But password strength testers don’t consider that - guessing “aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa” randomly also takes billions of years, so they can give a bit of a sense of false security.
Eh it’s still pretty hard.
If we check the numbers of English words from https://www.merriam-webster.com/help/faq-how-many-english-words and take a conservative estimate of 400 000 at the bottom of the page.
That means with the exact format of (word)(number)- 4 times has (without repeating words) 400000*9*399999*9*399998*9*399997*9 = 167957820891293697014400000 combinations. https://www.wolframalpha.com/input?i=400000*9*399998*9*399997*9*399996*9
The fastest super computer at the moment apparently sits at 1.1 quintillion Hz. Or 1.1 billion billion.
If that computer could make 1 guess every clock cycle it would still take it over 4 years (167957820891293697014400000 / 1.1quintillion = ~52 months ) to run through all possibilities.
Now that is a very fast computer, and we haven’t included the possibility of various numbers of words, different delimiter, or where and how often numbers appear. So unless you’ve really pissed off the US gov I don’t think you have to worry about it.
There’s a reason passphrases are the currently recommended way to generate secure passwords that are hard to guess but easy to memorize/type in.
I also tweak my base password based on the site. One site hack could lead to all your passwords being compromised no matter how long it is. Sure someone might be able to figure out the pattern if they analyzed it manually, but most hacks try to break into accounts en masse and they’re not going through passwords one by one.
Just use a password manager!
All of my password look like this, and even I don’t know what they are for any given site. And each site has a unique one.
.S"uB3U-_5X?e8XRa:2JEdit: I just saw your other comment, but you said plural “passwords”, so I’m leaving this up.
Yeah, but pass123! is easier to type.