Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to make for more secure passwords. Now I understand that some password strength checkers can be bogus or not very accurate so I'm hoping someone can shed some light on whether or not length is more secure than complexity and why. Here's the password I'm testing:

this password is supposed to be weak and easy to crack but its strong

  • All Lower Case
  • Dictionary Words
  • 69 Characters Long

I've ran this 'password' through 3 password strength checkers:

Each of these websites says that my password is very strong. I realize this makes a password hard to brute force but what I don't understand is how this make it secure from things like dictionary attacks since it's all lower case and all dictionary words. Is it accounting for the human factor?

Obligatory XKCD Comic

share|improve this question

marked as duplicate by Rory Alsop Apr 28 '13 at 20:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

This may be a duplicate of this earlier question: – Xander Apr 28 '13 at 20:16
The xkcd inspired question should answer this completely :-) – Rory Alsop Apr 28 '13 at 20:46

Simply because exponential growth is much faster than polynomial growth.

For a password which has a fixed length n, where the number of characters in your character set (x) is variable will give you a complexity of xn.

This is a polynomial function, and grows accordingly as x is increased.

On the other hand, fixing the character set to n and keeping the number of characters x variable gives you exponential growth nx. This increases much faster as x is increases. (Compare the derivateves for reasonable values of x and n if you wish)

Basically, for reasonable values of x and n, increasing x is much more effective in increasing complexity in the second case.

enter image description here

This is why the strength checkers say that it is secure.

However, using dictionary words does open it wide for dictionary attacks, which can be less secure. Try to use a few random strings in there as well.

share|improve this answer
@Howdy_McGee: Well, yeah. 2^x represents exponential growth (which is generalized to n^x) – Manishearth Apr 28 '13 at 21:31
If the attacker knows that a password is composed only of correctly spelled lower case English words, then you don't have to attack character by character. You attack word by word. – Zoredache Apr 29 '13 at 4:00
@Zoredache: I know, that's why the last line is there. – Manishearth Apr 29 '13 at 4:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.