Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have found a flaw in a site where the password reset feature resets passwords in the following format


Eg: A0b1c2d

I'm trying to determine how many possible password combinations there are for a system like this (where i can predict the 'password format' vs something random that uses the entire Upper/Lower-Alpha-Numeric Keyspace.

I'm not a cryptographer but this seems like a significant weakness to me. I'd like some data to back that assumption up :) Cheers

share|improve this question
I think it turns out being 456,976,000 passwords vs 3,521,614,606,208 (for 7 chars)? – NULLZ Mar 26 '13 at 1:14
up vote 7 down vote accepted

To get the number of permutations, multiply the number of possibilities at each position:

26x10x26x10x26x10x26 = 456,976,000

share|improve this answer
Which, just to clarify, is a pitifully small pool of potential passwords. – Stephen Touset Mar 26 '13 at 2:19
Yes... Wasn't trying to convey that this number is sufficient... Only to show how to derive the answer. – BrianAdkins Mar 26 '13 at 2:29
No worries. Just thought it warranted explicit mention. – Stephen Touset Mar 26 '13 at 2:30

I would like to mention on top of the other answer(s) in regards to the weakness of this particular system, a password reset feature is only for temporary passwords. The password could be reset because a user forgot it or has been locked out of the system.

Since the user requests that the password reset, with some other form of validation of account ownership like email address, the password should only be active for around 5 minutes or less. If the password reset is implemented securely, it may lock the account after 10 attempts to deter brute force at the time of password reset. However, this attack is probably unlikely to happen with the small time constraint.

If an attacker gets ahold of the encrypted database passwords, then they may be able to bruteforce the table of temporary passwords to try and log in before the user is able to. In this case, having a small password is a weakness but they probably have other weaknesses as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.