If i use a single word to form a password by repeating it like the examples below:




Would a similar pattern (repeated symbols) appear in the encrypted format of the password (NTLM, MD5, etc)?

6 Answers 6


Here's a place you can try it out with a bunch of different algorithms: http://www.crypo.com/tools/index.php

But the answer is no you will not see any repeating pattern. You may see that with xor encryption but you will never see that with a strong encryption algorithm. Password padding and repetition can be very secure unless someone knows that is what you do. To counter that all you have to do is throw in one or two extra characters to break the pattern and make it strong.

For example: securesecuresecuresecure.securesecure.


Against a bruteforce attack the latter would be more secure, but the overall length of your password would already be hard to guess.

If someone however would know that you always repeat a regular word with a fixed amount of times, then a dictionary attack might be easier performed with the first example. (providing the person doesn't know about your signs)

With modern encryption techniques (1 way hashing and CBC) there isn't an easy way to notice repeated words.

  • so if i use one word and repeated there is no such a thing mean Repeated encrypted symbol even if i use just one letter like ' aaaaaaaaaaaaaaa ' ?
    – rezx
    Commented Apr 9, 2012 at 11:46
  • 1
    not in modern encryption algorithms if I'm not mistaking. Commented Apr 9, 2012 at 12:52
  • so password padding is really secure > exmp. password%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
    – rezx
    Commented Apr 9, 2012 at 12:57
  • 2
    @rezx It should be noted that many password-based authentication systems do not allow characters to be repeated more than twice consecutively.
    – Iszi
    Commented Apr 9, 2012 at 13:55
  • 4
    @rezx - Because the strength of the password does not increase if you repeat characters. The length is only important in the context the password must be strong enough not to be a trivial calculation to brute force.
    – Ramhound
    Commented Apr 9, 2012 at 17:37

If you are unlucky, then a repeated password can result in a repeated encrypted text, it depends on the encryption that was used.

I never heard of patterns in a hash algorithm, so if a website only stores the hash (what it should), then you propably won't get such repeating patterns.

Should a website store the encrypted password, it can happen that you will see repeating patterns, if the ECB mode was used. That's why one should not use ECB anymore, instead use CBC or another mode. Here you will find a better explanation about EBC and CBC with good examples.

  • 1
    a cryptographic hash can't have repeats.
    – ewanm89
    Commented Apr 10, 2012 at 10:49
  • @ewanm89 - Yes, that's what i assumed and wrote in the answer, but since i cannot prove that no such algorithm exists, i formulated it cautiously. Commented Apr 11, 2012 at 22:15
  • that's why I stated "cryptographic hash" specifically :P
    – ewanm89
    Commented Apr 12, 2012 at 12:58

If what the password is subject to, was encryption, and if that encryption was poorly done, then patterns in clear data could be seen in the encrypted output. However, properly done encryption does not have this problem, and, more importantly, passwords are hashed, not encrypted. Encryption uses a key and has an output size which is roughly proportional to the size of the input; hashing uses no key, and has a fixed output size.

Of course, repeating a password in a long sequence does not make it stronger; it just makes it longer. Password strength comes from randomness, not from length. A long password has more room for randomness (so it can help fitting more of it), but if you repeat the same string, then you are not putting any randomness in it, so the extra length comes to naught. You just made the password frustratingly harder to type.

Using the word "secure" in a password does not make it secure either -- quite the contrary, indeed, because "secure" and "password" are among the most common words used in passwords by unwary users (who certainly styled themselves as "witty").


No, repeats in your password will not be visible in the password hash.

However, if you are thinking using this to strengthen your password: don't. It is not a good strategy. Repeating a secret word multiple times does not appreciably increase the strength of your password. Sadly, there are no shortcuts for password choice; your password needs to be long, strong, and unpredictable.

  • why not increase the strength of my password, it will be long and hard to predict, and contain all 96 characters. exp: !2Qw!2Qw!2Qw!2Qw!2Qw!2Qw ( numbers, symbols, capital and small letters)
    – rezx
    Commented Apr 11, 2012 at 8:01
  • 1
    @rezx, as I already wrote, this does not appreciably increase the strength of your password -- like it or not. That's because it does not make it that much harder to predict.
    – D.W.
    Commented Apr 11, 2012 at 8:25
  • ok, lets forget about 'predict' for now cuz when u try to break a file u cant know how i choose my password, so about strength it hve all what it need to make strong password, length, numbers, symbols, capital and small letters
    – rezx
    Commented Apr 11, 2012 at 9:19
  • 4
    @rezx, I find this conversation puzzling. You seem certain that repeating a string many times will increase the strength of your password. If you're sure you already know the answer, why are you asking here? I'm telling you that your assumptions are wrong, and that repeating a string many times does not significantly increase the strength of your password. It is up to you whether you want to listen or not. P.S. I suggest reading about "security through obscurity".
    – D.W.
    Commented Apr 11, 2012 at 9:27
  • @rezx, if it help to convince you, one of the most common rules applied to password dictionaries when running an offline attack on a stolen database, is to try repeating each entry several times. Note that a "password dictionary" contains many many non-words; basically any actual password that has been used before and is present in a leak can be in a password dictionary, including short seemingly random character sequences. If your short sequence you repeat happens to be in a leak somewhere...or is a 1337 transformation of a password in a leak somewhere...then it's game over.
    – Ben
    Commented May 6, 2016 at 14:55

Some encryption algorithms that work on blocks may use a method known as block chaining, whereby each previously encrypted block is XOR'd with the next consecutive block to prevent repeating patterns. If this or other methods aren't used then repeating patterns will be seen in the encrypted data as in algorithms that use an Electronic Code Book method.

Wikipedia - Block Cipher Modes

Hashing algorithms are generally very good at disguising repeating patters as they strive to achieve the avalanche effect, whereby the changing of one individual bit creates a massive change in the output so even with a repeating pattern the change would be massive.

Wikipedia - Avalanche effect

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .