26

While messing around with the Cygnius Password Strength Test I noticed that if you enter a sequence like

wsdxcv

the test labels it as a "spatial" pattern — obviously because the keys are close together on a qwerty keyboard, if on different rows.

Googling around I can hardly find any mention of the idea, and I can't imagine it'd be especially common anyway (outside of one-handed passwords). Plus there may be multiple keyboard layouts to consider.

So the question is, are cracking algorithms actually likely to take this pattern into consideration?

1
  • 2
    It's not as uncommon as you want to think. I've seen it for production accounts.
    – jpmc26
    May 29, 2017 at 7:00

1 Answer 1

39

This method of creating a password by pressing adjecant keys is called a keyboard walk. Password crackers kind of take this into account; they don't explicitly try keyboard walks, but the most common keyboard walks are contained in password dictionaries. So crackers will test for qwerty, not because it is a keyboard walk but because it is a common password.

There are some tools to create dictionaries with password walks:

  • HashCat's kwprocessor, a keyboard-walk generator with configureable basechars, keymap and routes.
  • passpat can identify passwords that are keyboard walks.
  • Generating Keyboard Walks, a blog post and software to create keyboard walks.
2
  • Nice to know there's another name for this pattern. Good answer, useful references.
    – Cauterite
    May 28, 2017 at 8:41
  • 10
    I can also say, from personal experience, that keyboard walks are probably the easiest sort of password to shoulder surf.
    – Tacroy
    May 29, 2017 at 1:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .