Does using characters specific to language make password stronger

Question

So let's start of example. I live in England, and have a Polish keyboard. I can use Polish specific letters like ąćęłńóśżź, one could also use German ßäë etc.

Would using those letters make password stronger?

I think that definitely it would decrease chance of random person guessing my password, as they may not be able to input required character.

I also think that this would make password stronger as usually even if database is stolen brute force programs usually goes through standard a-z, 0-9 and special characters like !@#$%^&*()_+=- etc. But it seems that those language specific letters are not used to find password.

Answer 1

Using characters specific to language does make password stronger, but not exactly for the reason you stated. If you count on the attacker not including your language specific characters into their dictionary, then your password will only be safe until they know that you are using a non English alphabet. And according to Kerckhoffs's principle , you should presume that they already know this.

However, if you use your specific characters along with character in English alphabet, your password will become stronger simple because each character in your password will have more entropy. Let's say we are using a randomly generated, lower case only password (in practice you should mix both lower case, upper case and special character, but the basic is still the same). Take your Polish alphabet for example, if you combine Polish and English alphabet, you will have 35 distinct characters, while the English alphabet only has 26. That means each character in our Polish+English password will have roughly 5.13 (log2(35)) bit of entropy, while a character in the English password will only have around 4.7 (log2(26)) bit of entropy.

Now let's say our password is 15 characters long, in the first case we have 15 x 5.13 = 76.95 bit of entropy, while in the second case we only have 15*4.7 = 70.5 bit of entropy. If you keep mixing more and more different alphabets, then each character in you password will have more and more entropy, and your password will become stronger given the same length. However you run the risk of not being able to login from other devices because they don't have your language keyboard installed, that's something you should keep in mind.

Answer 2

Not in any reliable way. In theory a larger character set increases the search space for the attacker, but that only reliably helps you if you pick passwords at random (literally at random, for example by throwing dice), which I suspect is not what you have in mind.

But in practice, there's several problems. First of all, there's too many programmers out there who are incompetent and disdainful when it comes to character encodings, and routinely write software that doesn't handle them consistently. So you risk all sorts of issues:

1. A website may do something funny to your passwords' diacritic-carrying characters—like replacing them with ? or just deleting them. This is terrible, because your password in that case doesn't have the strength that you expected and you wouldn't even be able to tell.
2. Suppose then that such a website updates their software to fix the bug. Ooops, now it doesn't recognize your password anymore!
3. Or the developers, without giving much thought to it, might decide to implement a front-end "permissible password" check that forbids non-ASCII characters.

Second, the way you're approaching the question can be boiled down to this:

• "Can I outsmart the password crackers if I use this clever trick?"

They're going to spend a lot more time studying how to outsmart users than you're going to spend studying how to outsmart them. They'll just read all they can find in the Internet about how people pick their passwords (including this question!) and learn from it to improve their password attacks. Remember, they don't just try to crack your password by guessing it individually—they program really powerful computers to test millions of passwords per second, and use them to guess thousands of users' passwords at a time.

So I don't know, but I sure wouldn't bet on you.

The only reliable way to defeat password crackers is to pick passwords at random from a very large set. The Electronic Frontier Foundation's page on creating strong passwords has good advice. The most important is to use a password manager program to generate and store a unique, random password for each site. That's it.