Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Everyone knows the words used in Diceware passwords (all 6^5 = 7776 words are published) -- they're all common words. Everyone seems to know that we're not supposed to use dictionary words for passwords because the "dictionary attack" can rapidly guess a single dictionary word. So it seems reasonable to leap to the conclusion that a dictionary attack can also guess a Diceware passphrase pretty quickly.

Can a dictionary attack mounted now (2012) crack a Diceware passphrase before 2033?

In particular, is the claim on the Diceware page "A seven word pass phrase is thought to make attacks on your passphrase infeasible through 2033." accurate?

Is that still true even if the attacker knows that I always use Diceware passphrases, and knows which language I use?

How does a five-word Diceware passphrase compare to the common recommendation of 9 "completely random-looking gibberish" characters?

(I'm asking a very specific question about the recommendations on the Diceware page, since related questions passphrases - lowercase and dictionary words and XKCD #936: Short complex password, or long dictionary passphrase? seem to get sidetracked onto things that are not really Diceware passphrases).

share|improve this question
Looking at the xkcd question - the answers there appear to cover off this question completely, especially danbeale and dr jimbob's answers. – Rory Alsop Jan 3 '12 at 8:59
Diceware assumes that everyone is doing a known dictionary attack when they calculate how long it takes to crack. If you aren't doing a dictionary attack, it's far more secure. – endolith Feb 6 at 15:30
up vote 28 down vote accepted

5 Diceware words = 77765 = 28430288029929701376 possible equiprobable passphrases.

9 random characters = 949 = 572994802228616704 possible equiprobable passwords.

The 5 Diceware words are 49.617 times better than the 9 random characters. On the other hand, 10 random characters would be almost twice as good as the 5 Diceware words (but the Diceware words are probably much easier to remember). (I assume that your "gibberish characters" are ASCII printable characters, excluding space.)

With seven words, the number of possible and equiprobable passphrases is a bit higher than 290, which is indeed quite high; even if the employed password hashing scheme has been horribly botched (no salt, simple hashing), this still exceeds by a comfortable margin what can be done with today's technology.

The important word is equiprobable. This is what makes the analysis above possible and accurate. This assumes that both your Diceware words, and the 9 "random-looking gibberish characters", are chosen with a truly random uniform process, such as, for instance, dice. And not at all by a human being in the privacy of his brain, imagining that he can make random choices out of pure thought (or, even worse, witty non-random choices). Humans are just terrible at randomness.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.