6

Say that someone asked how secure my password is, if I give them the https://howsecureismypassword.net/ results of it, (especially if I disable the named numbers mode,) can that person brute force with the website's algorithm and possibly find my password?

9
  • Eventually, maybe. But you do rotate your password, right? Why not change a character or two?
    – schroeder
    Jan 27, 2016 at 16:20
  • do you mean the details? Like length, character combinations, etc.? Jan 27, 2016 at 16:46
  • 4
    This website is utter idiocy. No, P@ssword is not significantly harder to guess than password. Jan 27, 2016 at 17:03
  • 2
    Might be a good idea to run such a site and log all passwords and wait for users bragging how good there password is. Then just compare their claim against the logged passwords. Jan 27, 2016 at 17:13
  • 1
    @ParthianShot obligatory xkcd Jan 28, 2016 at 1:29

2 Answers 2

2

By posting those results, you are limiting the pool of guesses the person has to use. However, this does not make brute forcing faster in a practical way, it simply limits the guesses the person will try. With a strong password, this brings diminishing returns -- excluding guesses without numbers or symbols doesn't help all too much.

However there is one exception: if the site reports you're using a "commonly used password" then it makes brute forcing extremely fast. And if you're using a password from that list, you deserve it!

1
  • -1. If you are using a commonly used password, you're already screwed. Posting the results in that case makes no difference.
    – forest
    Dec 13, 2017 at 2:12
-4

There should be no risk. The password you enter on https://howsecureismypassword.net/ is in no way related to where you actually use it. (Or don't tell the one who knows where you use it that you used https://howsecureismypassword.net/ for this :)

Say you test your password that you use on amazon.com ... You can enter that fine on https://howsecureismypassword.net/. Als long as there is no relation to that fact that you're using it on amazon.

1
  • 2
    Ever heard of credential stuffing? Trying a couple passwords on many websites is a lot easier than trying millions of passwords on one website. Jun 8, 2019 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.