6

Say that someone asked how secure my password is, if I give them the https://howsecureismypassword.net/ results of it, (especially if I disable the named numbers mode,) can that person brute force with the website's algorithm and possibly find my password?

9
  • Eventually, maybe. But you do rotate your password, right? Why not change a character or two?
    – schroeder
    Commented Jan 27, 2016 at 16:20
  • do you mean the details? Like length, character combinations, etc.? Commented Jan 27, 2016 at 16:46
  • 4
    This website is utter idiocy. No, P@ssword is not significantly harder to guess than password. Commented Jan 27, 2016 at 17:03
  • 2
    Might be a good idea to run such a site and log all passwords and wait for users bragging how good there password is. Then just compare their claim against the logged passwords. Commented Jan 27, 2016 at 17:13
  • 1
    @ParthianShot obligatory xkcd Commented Jan 28, 2016 at 1:29

2 Answers 2

2

By posting those results, you are limiting the pool of guesses the person has to use. However, this does not make brute forcing faster in a practical way, it simply limits the guesses the person will try. With a strong password, this brings diminishing returns -- excluding guesses without numbers or symbols doesn't help all too much.

However there is one exception: if the site reports you're using a "commonly used password" then it makes brute forcing extremely fast. And if you're using a password from that list, you deserve it!

1
  • -1. If you are using a commonly used password, you're already screwed. Posting the results in that case makes no difference.
    – forest
    Commented Dec 13, 2017 at 2:12
-4

There should be no risk. The password you enter on https://howsecureismypassword.net/ is in no way related to where you actually use it. (Or don't tell the one who knows where you use it that you used https://howsecureismypassword.net/ for this :)

Say you test your password that you use on amazon.com ... You can enter that fine on https://howsecureismypassword.net/. Als long as there is no relation to that fact that you're using it on amazon.

1
  • 2
    Ever heard of credential stuffing? Trying a couple passwords on many websites is a lot easier than trying millions of passwords on one website. Commented Jun 8, 2019 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .