# Is the password FFFFFggggg&&&&&22222 safe from being guessed? [closed]

It is 20 characters long, mixes alphanumeric and special symbols. It is one among ** 20.

• @PierreB not anymore Mar 21 '16 at 20:46
• That depends on what set of rules your attacker is using to generate guesses. if "repeated charecters" is high on the list, then NO. Mar 21 '16 at 20:46
• By your logic, "aaaaaaaaaaaaaaaaaaaa" is a secure password as it is one of **20 (I assume you mean 64 to the power of 20) passwords. Basing password strength just on length is clearly wrong. Mar 22 '16 at 1:56
• Regular, repeated patterns are always a bad idea. It's what got Enigma cracked. Mar 22 '16 at 4:36
• @PierreB if this question is about thinking how to create safe passwords, there are numerous detailed questions and answers on this site to explain how to do that. Your question is constrained to analyzing a single password. Mar 22 '16 at 5:17

Well I guess now that you stuck it on here, someone will probably add it to a dictionary list, so that specific one probably isn't anymore.

• This is not even an attempt at answering the question. It is just a comment and a non-constructive one. Mar 22 '16 at 4:11
• I think this does actually answer the question quite well. It is a terrible question. Mar 22 '16 at 8:51
• Furthermore, it states that "any password that is shared is by definition insecure", which is very relevant. Nov 13 '18 at 19:30

The problem with this password is that it is based on a pattern. As long as your pattern remains a secret, then it has some value. But, as soon as your pattern becomes known, then it is only as good as a 4 character password.

The best case is to have a password that is still strong, even if the world knows how you generated it.

There are lots of hackers out there trying to crack passwords. At least one of them is bound to have rules for Repeated Characters high up in their guessing order.

The security of a password depends roughly on its entropy, which itself is a metric of how much information it contains. The password "AAAAA" has terrible entropy, since it's the same character repeated five times. On the other hand, "e^#Yc" is, whilst still way too short, much better. It can't be described as easily.

Relying entirely on repeated characters is bad because there just aren't that many ways to do so. You only have four unique characters in the password. If I tried every way to combine four alphanumeric/symbol characters, I'd get 72^4=26873856 combinations. If I were to use up to five copies of each symbol, then there would be 72^4 * 5^4 combinations (since I can use 1, 2, 3, 4, or 5 of each character, which is only 5 choices). This gives 16796160000 combinations. Whilst better, it's still not that good. Using ten random alphanumeric/symbol characters would give 3743906242624487424 combinations, for example.

I think your problem is a misunderstanding of password strength. Mixing letters and symbols, using capital letters, and so forth are ways to increase the search space of a password. The larger the search space, the harder it is to break a password, since the number of possible passwords is (search space)^(length).

However, if your password is either very short or effectively very short (repeated characters are an example of this), then it's still weak!

• This is misleading: "The password "AAAAA" has terrible entropy (...) "e^#Yc" is, whilst still way too short, much better." Entropy does not qualify password. If a validating system would allow the second pattern, the entropy does not change just because you set "AAAAA" as a password. Mar 22 '16 at 3:35
• I'm sorry? I don't understand what you're saying here. The entropy of a piece of data describes how much it is like random noise; information that is "consistent" has less entropy than data that is not. Apr 4 '16 at 2:57
• There are different definitions of entropy. I think when talking about brute-forcing a password this one applies: Entropy as a measure of password strength. It does not qualify a password, but a system and for the two sequences-of-bits from this answer the entropy is the same, regardless of one sequence having a more appealing literal representation to human. Please correct me if I am wrong. Apr 4 '16 at 3:47
• Think of it this way: a very regular `111100001111000011110000` might be represented by 5 different characters `11110` `00011` `11000` `01111` `0000x`. Unless you considered how a given system renders `AAAAA` or `e^#Yc` you can't say anything about their entropy in a data randomness-sense. Apr 4 '16 at 4:09
• I said using your definition of entropy was misleading, you asked for clarification, I have given reasons and references, now you don't answer this, but instead rely on the definition I said was misleading. That's exactly why it is misleading. Apr 4 '16 at 5:43

It would depend on how the hypothetical attacker approaches guessing the password.

Against a simple brute-force attack (i.e. trying every possible combination in the available key space) this password would most likely hold up very well indeed, because it's very long. Unfortunately, most attackers won't be using pure brute-force attacks.

It could also be expected to do well against a pure dictionary attack, for obvious reasons.

However, a clever attacker might be reasonably expected to account for patterns like repeated or sequential characters in their attack. Since this password's structure is very regular (5 repetitions each of just 4 characters) it would fall much more quickly to an attack that's looking for patterns.

Suppose an attacker were to gain access to a password database containing a hashed version of this password (as happens all the time.) Let's say the attacker has already exhausted their dictionary attacks and is turning to pattern-based attacks. Such an attack could be expected to take into account logical sequences (e.g. 12345,) spatial sequences (e.g qwertyuiop,) repetitions, etc. and various combinations of them. I don't know if I could reliably estimate the size of such a key space, but it would certainly be significantly smaller than if the key were truly random. This question has some discussion about the principles behind pattern-based password cracking.