Say that someone asked how secure my password is, if I give them the https://howsecureismypassword.net/ results of it, (especially if I disable the named numbers mode,) can that person brute force with the website's algorithm and possibly find my password?

  • Eventually, maybe. But you do rotate your password, right? Why not change a character or two? – schroeder Jan 27 '16 at 16:20
  • do you mean the details? Like length, character combinations, etc.? – Stef Heylen Jan 27 '16 at 16:46
  • 4
    This website is utter idiocy. No, P@ssword is not significantly harder to guess than password. – Steve Dodier-Lazaro Jan 27 '16 at 17:03
  • 2
    Might be a good idea to run such a site and log all passwords and wait for users bragging how good there password is. Then just compare their claim against the logged passwords. – Steffen Ullrich Jan 27 '16 at 17:13
  • 1
    @ParthianShot obligatory xkcd – dave_thompson_085 Jan 28 '16 at 1:29

By posting those results, you are limiting the pool of guesses the person has to use. However, this does not make brute forcing faster in a practical way, it simply limits the guesses the person will try. With a strong password, this brings diminishing returns -- excluding guesses without numbers or symbols doesn't help all too much.

However there is one exception: if the site reports you're using a "commonly used password" then it makes brute forcing extremely fast. And if you're using a password from that list, you deserve it!

  • -1. If you are using a commonly used password, you're already screwed. Posting the results in that case makes no difference. – forest Dec 13 '17 at 2:12

There should be no risk. The password you enter on https://howsecureismypassword.net/ is in no way related to where you actually use it. (Or don't tell the one who knows where you use it that you used https://howsecureismypassword.net/ for this :)

Say you test your password that you use on amazon.com ... You can enter that fine on https://howsecureismypassword.net/. Als long as there is no relation to that fact that you're using it on amazon.

  • 1
    Ever heard of credential stuffing? Trying a couple passwords on many websites is a lot easier than trying millions of passwords on one website. – AndrolGenhald Jun 8 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.