In the case of data breach, long, complex passwords may draw more attention than simpler ones and the attacker might prioritize accounts with the most sophisticated passwords . Given that "it is generally accepted that 128- bit of entropy is beyond anyone's capability to brute-force", very complex passphares most likely won't provide additional security, but is there a reason to believe such passwords can even be dangerous to use?

.7¬£É6wÈ7%$»ª-$¢EÁº.¢vcnK=L´=sís(:ã^¤íñþp_}01çxfè§ä¬zAý¦jþ²¨¨ä`BÁ!A´Ú;çO5ý{ªõtqvuÄÃyJh6r5×ÓôJ¾/^:'Þkã+ìÃÔ«^Ôdf¡bSÞÃÆ1îP;K§IëüèEfrNÑvÛ]4ÁC¨Â{TaqÑ?û~ÑZ¼XÍSñiêkæ`úñ0CÃ?Ť^-ÞéBÊoó·*|èhýþKîzô¤³MCyªaúïÐæW,¦¾Ë"æmUò\3³CZ'!Õ¿¡6õ´[Å^7UÂùð8WW\ÇÎ߸÷O$YýyqîHY-×±T÷ù;V±Çͤöò0Vp9ñþü3Ä7·OhöP/õ6sãuI<£è5eebë¬ÔgUÑÕã~DN0f>çÃþL¥²¦`êäS[d;PÂ~[ZóÇ/aÀÃ!þÚåÔ£r@#`\´Z(h(½BàæÎ_¦¸-ÅÒcâhA+iAç÷×éê,'ºL}³ãm ·~9P¼¦hõkSìE'Á}-aoucõ¨Æ¯X¶6±¬tû¸=bg?êàòálqµ\í 2Õx:µ¾;AþTËÛë¬É«g<äúÈlõby=¾Uc×çBÙg!ÅTß+ç2K3ÛÌÄ6MY4]¡êùÒÝ´ôþ÷/k~T.>ó}¹jÉú0ï+¶

a complex 500-character password

marked as duplicate by Xiong Chiamiov, Community Jul 2 '17 at 19:32

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I didn't find a tag for data breach, I'm not sure if [data-leakage] is suitable. – user598527 Jul 2 '17 at 14:34
  • They won't be accepted by most services – eckes Jul 2 '17 at 14:39
  • 2
    Dangerous I don't think so, useless yes. As a side note, long and complex passwords are indistinguishable from simple and short ones once they're hashed using a proper algorithm, so I don't see how complex ones can be prioritized to crack – Mr. E Jul 2 '17 at 14:57
  • "long, complex passwords may draw more attention than simpler ones " citation needed – schroeder Jul 2 '17 at 19:06

In your example no. Most sites use password based key algorithms which are a form of hash function that takes as input the plaintext string (the actual password). The result from this functions is commonly a fixed length string output (can vary with sha3) and so any attacker looking at the stored passwords sees the same length regardless of actual length of original string.


Can using very long, complex passwords with online accounts be detrimental?

I'm certain that the example password above would survive any dictionary attack out there, as well as delay success of brute-forcing for quite some time. However, it is not very user friendly and would have to be written down somewhere in either electronic or physical form.

Both of which have weaknesses. Writing it down is prone to human error while electronic form on a device connected to the internet is prone to theft remotely. Of course both can also be stolen by hand...

So to answer your question, yes it can be detrimental. While it strengthens one security aspect, it completely fails on the other.

P.S. Agree with the answers above regarding hashing, 1 char or 500 chars password would provide same length hash string.


all passwords are hashed, so the attacker sees the same length. Bear in mind, that if a password is brute forced, the attacker will get the 1st password with the same hash, which is almost certainly not the 500 character password. if there is a 128bit hash, there must exist a password with around on average 16 characters with that hash, so these extra characters frankly provide no extra security. Dangerous - no, from a pure computational perspective.

  • What do you mean by "all passwords are hashed"? In this scenario? – user598527 Jul 2 '17 at 19:39
  • passwords are not stored as is. The sha128 or sha256 or result of other hashing algorithm is stored. any phrase that has thee same hash representation will work, and these phrases are 128 or 256 bits long. – camelccc Jul 2 '17 at 19:50
  • Are you saying that there are no websites that store passwords in plaintext? – user598527 Jul 2 '17 at 19:57
  • well - there certainly shouldn't be - I'm not going to promise there isn't one, but if they are doing that kind of security blunder, the strength of the password is the least of your concerns. It would violate every aspect of good practise. – camelccc Jul 2 '17 at 21:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.