For a password, is it better having a number in the middle than at the beginning or the end?

Question

Sorry if this was asked before but I could not find an answer to my doubt.

While trying to decide a new password for a given website I came across a password strength checker website that (somehow) claims that having a number in the middle positions of a password is better than having it at the beginning or the end.

Out of curiosity I have checked other websites dedicated to checking password strength like this and this, but none of them seems to see a difference between, say 4abcD and abc4D, as the first one does.

While I do not really believe such sites can be regarded as scientifically accurate, I am wondering if there is something true in the "claim" that having a middle number makes a password stronger than having the number at the first or last position. Does it really increase the entropy of the password?

Answer 1

If you put it in the middle of a word or sequence, where it would otherwise have been at the end, such as abc4D compared with 4abcD, then you have increased the entropy of the password because there are fewer sequences or words that would be susceptible to a dictionary attack. However, that can't be said for correct4horse compared to correcthorse4, yet the former is still considered to be secure. For that particular scanner, the reason that putting the number in the middle is considered more secure is because it deducts marks based on the number of consecutive letters, so putting a number in the middle reduces the maximum number of consecutive letters. However, while there is some merit to that, having the number in the middle has another big advantage - most people put numbers at the end of their password, so when someone tries to crack a password, they are more likely to try different numbers at the end than they are in the middle.

No password strength calculator will ever give a true value for how strong your password is, because there are so many variables involved (things like names and dates commonly occur in passwords, which can't really be checked against by a random scanner), so don't just believe that p@ssw0rd is a good password just because it is considered twice as secure as correcthorsebatterystaple. The password strength checker you linked is good because it explains what features it's looking for, but it is missing a dictionary check, which limits its accuracy considerably.