I'm building a PHP login system that uses a username and password at first to grant the user a token and uses that token to grant the user access to their account.

My original thought was to force the access_token to refresh often, closing the window for potential brute force attacks.

However, after thinking it over, I realize that the access_token may be more secure than a username and password...

If I have a username of 24 characters, and a password of 24 characters, won't a 128 character access_token still be more secure? Let's assume all are using alphanumeric characters.


It seems that the above statement was a bit veg. I'll be a bit more specific.


Example A

I have one system with a 24 character alphanumeric username and a 24 character alphanumerics password.

Example B

I have another system with a 128 character alphanumeric token.


If two computers set out to brute force both systems, which system would most likely take the longest?

  • Does the token change everytime a user enters their credentials?
    – Limit
    Jul 7, 2017 at 20:37
  • Yes - But that is beside the point. Even if it didn't, wouldn't it be more secure than a username and password? Jul 7, 2017 at 20:38
  • Apart from character size, the security would also depend on architecture. If you had a strong token but if an attacker can see it once and use it the next time, its as secure as the password
    – Limit
    Jul 7, 2017 at 22:39
  • Of course Limit, there are a lot of things that need to be considered. Right now I'm focusing on this aspect of the project. Jul 7, 2017 at 22:59
  • 1
    Fair but a lot of people just rely on the character size so wanted to ensure that you had covered the bases
    – Limit
    Jul 7, 2017 at 23:38

2 Answers 2


If you were to judge purely based on character size and wanted to compare a 24 character username and 24 character password system vs a 128 character token system, I would say that the search space would be larger in the token based system.

Obviously, to brute-force a username/password combination, the user needs to find a pair in two n^24 search spaces while in the there are several elements in the n^128 sized token search space that will be valid tokens. As a result, it can happen that your brute-force system does find a token before it can find a valid username/password pair. But finding all valid username/password pairs will take less time than finding all valid tokens.

  • Are you saying it is likely that a brute force attack will find a valid token before a valid username and password? Or are you saying it is possible that a brute force attack will find a valid token before a valid username and password? Jul 7, 2017 at 23:57
  • @jacobhenning I am saying that it's possible
    – Limit
    Jul 8, 2017 at 0:17

Tokens are away to provide access to a resource without the need to have a session managed indefinitely. This allows you scale servers and limit overhead pretty effectively by authorizing a client to access a resource directly.

Your Username / Password is used to Authenticate a person. Once you can prove that person is who they say they are, you issue the access token.

Access Tokens are short-lived, and used to access resources directly, or in basic terms Authorization.

There are also Refresh Tokens, which are long-lived, and used to request a new access token after your current one expires.

In terms of security when discussion what you are trying to do, it's not a matter of Username/password vs Token. It's a matter of whether your trying to build a more stateless system (using access tokens) or using a more traditional approach and managing long sessions.

On top of that you really don't need to be rolling your own Token System. JWT (JSON Web Tokens) already implement the RFC 7519 standard for token based access which I recommend.

You may get security people that might favor traditional based sessions, but personally Token Based is a lot more pragmatic. OAuth has a nice little break down here.

  • Thanks Shane, everything you said was helpful and made sense, but you didn't really answer my question. Sure, I may not need to build out my own Token System, but I am and so I wanted to know where the biggest security risk is. If the login was less secure, I would rely more on tokens, and Vise Versa. Jul 7, 2017 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .