Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their password, you could essentially lower the space and calculations necessary to brute force their password. My question is, does anyone know by how much does it reduce?

If I KNOW that a password is 22 characters in length, obviously you are not going to try any potential password that is not 22 characters in length.

tl;dr How much faster is it to crack a password if you know the exact char length?

share|improve this question

marked as duplicate by Anders, techraf, Xander, S.L. Barth, Matthew Jul 19 at 16:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

If we assume that there are 128 possible characters in a password (2^7), then there are 2^154 possible 22 character passwords.

There are 2^147 + 2^140 + ... shorter passwords, which is pretty much the same as 2^147. So you have to do 1/128th less work if you know it's 22 characters and so don't have to try all the 1-21 character passwords first -- less than 1% less work, and not really significant.

share|improve this answer
    
Your answer is generally correct. (cracking slightly shorter passwords truly takes less time than cracking the full length) However, most people do not use 128 possible characters in their password. Primarily this is because the standard US keyboard supports only 95 characters. (62 letters/numbers, 33 other characters) – George Bailey Jul 19 at 12:12

See ophcrack rainbow tables. This will give you a good idea of how save passwords are for particular length and how set of used character make it more secure.

You can think: the bigger rainbow table must be to crack the passwords, the safer the password is.

Note, that making a password even one character longer makes it much longer to crack, so checking checking only n-long passwords compared to checking 1-long, 2-long, ... n-1-long, n-long does not really make much difference.

See Password_strength article.

So, to summarize - no, knowing the password length will not really help you crack the password.

share|improve this answer

The only time it could be relevant is for cracking a password that is very secure. Mike Scott's math is accurate, so lets presume that 22 character password is going to take 100 years to crack. If we don't know it's length then we'll waste 9 months attempting passwords that are too short. Then at a random point in the remaining 92 years the password will be cracked.

There is a small chance that we try the correct password very early in that period of time so there is a chance that if we'd known the length we would have guessed the right password in the first year, or the first week, etc.

Knowing the length of the password doesn't affect the average time to crack the password much, but it has a small chance of affecting the time a large amount. That should be weighted against the knowledge that some users will not bother to attempt to crack it if they know it is too hard to crack.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.