# Return to Answer

8 replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/

This might get better responses in crypto.stackexchange.comcrypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

7 replaced http://math.stackexchange.com/ with https://math.stackexchange.com/

This might get better responses in crypto.stackexchange.com or math.stackexchange.commath.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

6 added 7 characters in body

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeated WordsRepeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeated Words: 7776 * 7775 * 7774 * 7773 * 7772 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

This might get better responses in crypto.stackexchange.com or math.stackexchange.com, but I think I can give you the gist of it.

If we step away from words and take a look at some numbers it might help to illustrate.

Take for example a four-digit code for a lock.
There are 10 possible digits (0-9) and four spaces where they can be entered, so there are 10 * 10 * 10 * 10 = 10^4 = 10,000 possible combinations.

If you say there can be no repeating digits, then on the first space you would have 10 possible digits, on the second 9, on the third 8, and finally 7 possible digits on the last space.
This leaves 10 * 9 * 8 * 7 = 5,040 possible combinations, or, about half.

If we apply this to your password maker, we would take the total number of words you are using as possibilities (most Unix systems come with an English dictionary with around 200,000, so we can use this number for now), and the total number of words in your password (using 6 as the minimum Diceware recommends).

This means that without any restrictions on repetition, there are exactly 200,000^6 = 64 nonillion possible password combinations.

If you were to disallow any repeating words, there would be 200,000 * 199,999 * 199,998 * 199,997 * 199,996 * 199,995 ≈ 63.995 nonillion possible password combinations.

That is a difference of approximately .00008%.

As you can see, with a dictionary of at least 200,000 unique words and a keyspace of six words, the difference between no password restrictions and and limiting repeating words is negligible.

This difference would then have an equally negligible effect on the password's resistance to cracking.

### EDIT

LieRyan has pointed out Diceware uses a wordlist of 7776 common, easy to type words. If we wanted to see the difference with a list of that size, it would look something like:

No Restrictions: 7776^6 ≈ 2.21 sextillion possible combinations.
No Repeats: 7776 * 7775 * 7774 * 7773 * 7772 * 7771 ≈ 2.2064 sextillion possible combinations.
Difference: ~0.19%

Let's take a look at what that means to someone trying to crack your password.

Assume your adversary is capable of one trillion guesses per second. -Edward Snowden, 2014

If we take this estimate (emphasis), we would divide the total number of possible combinations by the number of guesses/second to get the total seconds taken to bruteforce every combination of the wordlist.

That is, 2.2 sextillion combinations / 1 trillion guesses/sec = 2.2 billion seconds = 69.72 years (compared to 70.03 years without password restrictions)

This is the average time it would take a well-funded and equipped password cracker (with access to a copy of your wordlist) to bruteforce a password made with this method.

5 deleted 1 character in body
4 deleted 1 character in body
3 deleted 1 character in body
2 added 1 character in body
1