It is 20 characters long, mixes alphanumeric and special symbols. It is one among ** 20.

  • 57
    @PierreB not anymore Mar 21, 2016 at 20:46
  • 2
    That depends on what set of rules your attacker is using to generate guesses. if "repeated charecters" is high on the list, then NO. Mar 21, 2016 at 20:46
  • 3
    By your logic, "aaaaaaaaaaaaaaaaaaaa" is a secure password as it is one of **20 (I assume you mean 64 to the power of 20) passwords. Basing password strength just on length is clearly wrong. Mar 22, 2016 at 1:56
  • 2
    Regular, repeated patterns are always a bad idea. It's what got Enigma cracked. Mar 22, 2016 at 4:36
  • 3
    @PierreB if this question is about thinking how to create safe passwords, there are numerous detailed questions and answers on this site to explain how to do that. Your question is constrained to analyzing a single password.
    – schroeder
    Mar 22, 2016 at 5:17

6 Answers 6


Well I guess now that you stuck it on here, someone will probably add it to a dictionary list, so that specific one probably isn't anymore.

  • 6
    This is not even an attempt at answering the question. It is just a comment and a non-constructive one.
    – techraf
    Mar 22, 2016 at 4:11
  • 25
    I think this does actually answer the question quite well. It is a terrible question.
    – Rory Alsop
    Mar 22, 2016 at 8:51
  • 3
    Furthermore, it states that "any password that is shared is by definition insecure", which is very relevant. Nov 13, 2018 at 19:30

The problem with this password is that it is based on a pattern. As long as your pattern remains a secret, then it has some value. But, as soon as your pattern becomes known, then it is only as good as a 4 character password.

The best case is to have a password that is still strong, even if the world knows how you generated it.


There are lots of hackers out there trying to crack passwords. At least one of them is bound to have rules for Repeated Characters high up in their guessing order.


The security of a password depends roughly on its entropy, which itself is a metric of how much information it contains. The password "AAAAA" has terrible entropy, since it's the same character repeated five times. On the other hand, "e^#Yc" is, whilst still way too short, much better. It can't be described as easily.

Relying entirely on repeated characters is bad because there just aren't that many ways to do so. You only have four unique characters in the password. If I tried every way to combine four alphanumeric/symbol characters, I'd get 72^4=26873856 combinations. If I were to use up to five copies of each symbol, then there would be 72^4 * 5^4 combinations (since I can use 1, 2, 3, 4, or 5 of each character, which is only 5 choices). This gives 16796160000 combinations. Whilst better, it's still not that good. Using ten random alphanumeric/symbol characters would give 3743906242624487424 combinations, for example.

I think your problem is a misunderstanding of password strength. Mixing letters and symbols, using capital letters, and so forth are ways to increase the search space of a password. The larger the search space, the harder it is to break a password, since the number of possible passwords is (search space)^(length).

However, if your password is either very short or effectively very short (repeated characters are an example of this), then it's still weak!

  • 1
    This is misleading: "The password "AAAAA" has terrible entropy (...) "e^#Yc" is, whilst still way too short, much better." Entropy does not qualify password. If a validating system would allow the second pattern, the entropy does not change just because you set "AAAAA" as a password.
    – techraf
    Mar 22, 2016 at 3:35
  • I'm sorry? I don't understand what you're saying here. The entropy of a piece of data describes how much it is like random noise; information that is "consistent" has less entropy than data that is not. Apr 4, 2016 at 2:57
  • 1
    There are different definitions of entropy. I think when talking about brute-forcing a password this one applies: Entropy as a measure of password strength. It does not qualify a password, but a system and for the two sequences-of-bits from this answer the entropy is the same, regardless of one sequence having a more appealing literal representation to human. Please correct me if I am wrong.
    – techraf
    Apr 4, 2016 at 3:47
  • 1
    Think of it this way: a very regular 111100001111000011110000 might be represented by 5 different characters 11110 00011 11000 01111 0000x. Unless you considered how a given system renders AAAAA or e^#Yc you can't say anything about their entropy in a data randomness-sense.
    – techraf
    Apr 4, 2016 at 4:09
  • 3
    I said using your definition of entropy was misleading, you asked for clarification, I have given reasons and references, now you don't answer this, but instead rely on the definition I said was misleading. That's exactly why it is misleading.
    – techraf
    Apr 4, 2016 at 5:43

It would depend on how the hypothetical attacker approaches guessing the password.

Against a simple brute-force attack (i.e. trying every possible combination in the available key space) this password would most likely hold up very well indeed, because it's very long. Unfortunately, most attackers won't be using pure brute-force attacks.

It could also be expected to do well against a pure dictionary attack, for obvious reasons.

However, a clever attacker might be reasonably expected to account for patterns like repeated or sequential characters in their attack. Since this password's structure is very regular (5 repetitions each of just 4 characters) it would fall much more quickly to an attack that's looking for patterns.

Suppose an attacker were to gain access to a password database containing a hashed version of this password (as happens all the time.) Let's say the attacker has already exhausted their dictionary attacks and is turning to pattern-based attacks. Such an attack could be expected to take into account logical sequences (e.g. 12345,) spatial sequences (e.g qwertyuiop,) repetitions, etc. and various combinations of them. I don't know if I could reliably estimate the size of such a key space, but it would certainly be significantly smaller than if the key were truly random. This question has some discussion about the principles behind pattern-based password cracking.


Try this service: https://howsecureismypassword.net/

According to this service, cracking your password would take 43 quintillion years with a regular computer.

  • 5
    That does not take into account dictionary and rule list attacks, amongst others Dec 8, 2016 at 9:34
  • @techydesigner Yes, as it is not supposed to be. You can't really take dictionaries into account. There may be a very complex password, yet it can be in a dictionary. Which happened to me recently. (Using same password in 2 systems, one of them was smth i really didn't care at all. Result: one of them compromised, password gathered and put in dictionary, and the other safe system cracked easily)
    – ferit
    Dec 9, 2016 at 10:42

Not the answer you're looking for? Browse other questions tagged .