How to generate easy to type passwords without sacrificing security?

Question

How can one generate a password that is easy to type but does not sacrifice security? An example of a password that is easy to type but sacrifices security (I imagine) would be qwe123!@#.

For this question, we'll use a pretty lax but standard password policy. Let's say:

• 8+ characters
• At least 1 capital letter
• At least one number
• At least 1 symbol

I am hoping this will take a little bit of the "usability" aspect out of the old adage "Security at the cost of usability comes at the cost of security". I am aware that a password manager or something like that would be a more ideal solution but not everyone is willing to incorporate something like that.

** After reading all the answers and comments here. My original intent for "easy to type" was something along the lines of near each other on the keyboard or alternating hands with smooth transitions between, which is why I accepted the answer I did. That said, the other answers (and the accepted one) have made me realize that I have been thinking about this the wrong way.

Answer 1

Disclaimer: I'm interpreting "easy to type" in this question literally to mean consecutive characters or similar typing patterns, which is different from passwords that are "easy to remember". I point this out because none of the other answers appear to interpret the question this way.

How to generate easy to type passwords without sacrificing security?

Short answer: Don't bother.

The reason is it's not worth it unless you are an extremely slow typist. I just tried an experiment where I choose two passwords, both were easy to remember, and one is (seemingly) much easier to type than the other. In order to more easily measure the timing with my stopwatch, I typed both passwords 3 times and compared:

Option 1: (12 seconds to type it 3 times)

This password is easy to remember
This password is easy to remember
This password is easy to remember

Option 2: (10 seconds to type it 3 times)

1234qwerasdfzxcv7890yuiohjklnm,.
1234qwerasdfzxcv7890yuiohjklnm,.
1234qwerasdfzxcv7890yuiohjklnm,.

I actually tried it a few times and the time shown above was my last set of 3 for each. The first couple of times I messed up the "easy to type" password because I was going too fast and bumped other keys.

My conclusion: it's likely to be the case that if you choose any passphrase that is easy to remember, it won't be much slower to type than one that is seemingly more "easy to type". (My average was 3.3 seconds vs 4.0 seconds.) Add to this the slightly higher probability that an easy to type password could end up in a dictionary list, and I'd shy away from it.

Answer 2

Mandatory "Use a Password Manager!". But you seem to already be aware of this. Moving on.

---

There are any number of tricks. In my experience, "easy to remember" and "easy to type" typically means "full English words"; my fingers/brain have a much easier time with words than they do with arbitrary sequences of characters. Two systems that come to mind are:

Diceware

Grab yourself a copy of the Diceware word lists [Article], [large_wordlist.txt] and roll some dice! This list of 6⁵=7,776 unique words was carefully selected to be easy to remember. Wikipedia gives these examples as typical diceware passwords:

• conjoined sterling securely chitchat spinout pelvis
• rice immorally worrisome shopping traverse recharger

Also: mandatory XKCD advocating passwords of this style.

Passphrase

I'm an advocate that we should ditch "password" from the English language - since it encourages people to think in terms of single words - and with the exception of a few especially moronic banks, all systems accept spaces in passwords now, so why not think in terms of "passphrases"?

A clever trick that I heard of is to set a passphrase that represents some personal-life goal you want to achieve or fact you want to remember. A) since you type your passphrase many times a day, it's a natural reminder to do the thing, and B) once you accomplish the thing, you have a natural reason to change your passphrase! The following would be examples that would naturally want to change after a month or so:

• "update $% on my 401(k)"
• "get under 10 Smokes/day"
• "Sandy's baby due on Aug 24th"
• "plan Grampa's 80th b-day party"

[ps. I'm waiting for the flame war on this suggestion. My generic answer: use a longer passphrase!]

Answer 3

Everyday I have to type my password like hundred of times. So I designed a password which was "Easy to type", following these suggestions (based in my own experience):

1) Better if I don't have to use the "pinky" fingers (they get tired after a long use). I suggest avoiding any character or symbol on the extreme left or extreme right of the keyboard. Because of that, no so many uppercase letters should be used (you need to use your pinky for the shift key, right?).

2) Upper case letters should be able to be typed with your right hand (if you are right-handed) or with the index and middle finger of your left hand. The reason is that its easy (for me) to use the left shift than the right (because is farther from the center). Try this: Shift+q seems to add pressure to your hand, compared with Shift(left hand)+P(right hand).

3) If you can type your password with a single hand is better. Sometimes I have one of my hands busy, and typing Shift+7 with a single hand may not be so comfortable. I would say that if you are going to use uppercase letters, try to keep those close to the shift key.

4) Adjacent letters are easy to type (for example: hj in an QWERTY keyboard) but are usually easier to make a mistake (jh instead of hj). My suggestion here is to try not to use adjacent characters in the middle or end of the password to avoid mistakes.

5) Flow is also important. I have found that is easy to type something when all letters/numbers/symbols are moving from one side to another (like playing the piano). If you start in the left side and you finish on the right of the keyboard (or vice-versa). It may be easier also to type with a single hand. For example: 9641 vs 9164 (using the right hand)

6) If you alternate hands while typing is easier (IMHO). For example: "jspenro" vs "jkustwp". Try to keep up to 2 characters per hand. Most of the English words are like that (hands alternate naturally).

7) Not so important, but if you are able to type it without looking it a plus. One of my passwords I don't even know it, but I can type it really fast (as I'm not repeating it in my head), I just let my hands to do it for me: Procedural Memory

The above points works for me, but they may not work for others. If you are looking for an-easy-to-type password for yourself try my suggestions. Otherwise, stick to what has been suggested already: use a Password Manager.

Answer 4

Dictionary passwords are the way to go. Wikipedia suggests that making a strategy predictable may not be the best route, but in this case it is.

From Wikipedia Information Theory/Entropy:

For instance, the entropy of a coin toss is 1 shannon, whereas of m tosses it is m shannons. Generally, you need log2(n) bits to represent a variable that can take one of n values if n is a power of 2. If these values are equally probable, the entropy (in shannons) is equal to the number of bits. Equality between number of bits and shannons holds only while all outcomes are equally probable

So if everything is equally probable, I'm as likely to put 'a' or '2' or '<' for a value, then options and length are all that matter. That considered, there are far more words than letters+digits+symbols in any language. Enough so that a 4 word password easily trumps a 10 character one.

To show how much of a difference:

26 letters in alphabet, 10 digits, maybe 15 symbols = ~50 options. 10 character password = 9.76 x10^16 options. If our computer's guessing 4 million a second, a rough, generous guess, we're at about 775 years to guess the password. Pretty secure. And, we can remember comfortably about 7 characters, 10 is doable, especially through password-style repetition.

This is with 10 characters, all equally weighted in probability, which is reasonable since it's likely to be gibberish that we'll have to right on the back of our hand to remember initially.

From that:

1) Length of the password is important in this case. Every character increases safety considerably. A longer password is always better. If for example we chopped our password down to 7 characters then we're at a meager max time of 2.25 days to crack with 50 options for each character.

2) But say if I make a password as the XKCD comic describes, nothing is stopping anyone from throwing a dictionary at a password like "remember elephant lost woods". Say if I use john the ripper, which has ~3000, with an option to make each plural or to chop off an s if it ends with one, then maybe ~6000 words. If there are 4 words in my password then 6000^4 possibilities = 1.3 x10^15, 10 years

Pretty secure. And, John the Ripper wouldn't actually crack the password:

correct horse battery staple

John the ripper is using common passwords. So common that only 'horse' actually shows up in there. Say if I use uncommon enough words that cracker dictionaries don't anticipate, then the last option is a legitimate dictionary-attack.

If I use fedora's default dictionary, with a very-comprehensive 500 000 words, for a 4-word password there are 6.25 x10^22 possibilities we're at about .5 billion years cracking time. But it's not farfetched to say that this could be cut down to at most 25% of its size, especially if common words like 'correct horse battery staple' are being used. So, 125 thousand possibilities. Still, 2.44 x10^20, which is about 2 million years.

What if we could cut it down to %1? So 5000 words. That's 6.25 x10^14 possibilities, nearly the same number as with the john the ripper attack, about 5 years max. Is it really feasable to cut it down to 1%? Probably not if the most common words aren't used.

But this also depends on whitespace delimiters. If I have

azkaban_P0tter*flubber st@ple Then we've destroyed the first equality of bits in the shannons conversation, but added an insurmountable amount of variables even if the attacker completely anticipates this tactic.

Also, if a smaller dictionary of say 200 000 could be used, reducing that to 1% is still maximum 45 days, and avoiding the most common words and using varying word delimiters would increase this duration drastically, and throwing in a word or two in another language if that's easy.

Answer 5

Have a look at this post I think it's very much related to what you've asked here:

XKCD #936: Short complex password, or long dictionary passphrase?

Also, that's a very theoretical question, I mean each one find different things harder to type i guess "qwe123" is indeed "easy to type" but some will argue that their names/things they like are "easy to type" passwords as well. Also you can interpret "easy to type" to "easy to remember" is that what you mean(?)

In my opinion an easy to type password without sacrificing security is first of all a long one, and than something that only you can think of (and if you use the methods that you mention inside that would increase the security of the password of course).

Answer 6

The fastest word for you to choose is dependant on two things:

1. your natural keyboard feeling
2. the maximum combination of simultaneous moves you can make

So what you want to do is

1. randomly type on your keyboard without trying to create a real word until you have a string of letters that's long enough. Don't smash your keyboard. Do fast but controlled moves that you feel are natural for you to repeat.

2. make sure that you alternate between right and left hand hence that's the fastest way of typing.

After like one minute I had this word: ichenfun

As you can see, its clearly readable and, at least for me, easy to pronounce and remember (maybe because I am German and ch is a simple sound)

It has 8 letters, but I don't suggest that you use it. Find your own word with this approach, maybe it helps.

Answer 7

An easy option would be concatenating Words as in: hellohereiam0x45 We gained a 16 Letter length password. Which will be resistant against simple brute forcing. You can even strengthen it like:

HelloHereIAm0x45

I simply capitalized every word to gain addition strength, without loss of memorization. Additionally you could abstract it even more like switching O with 0 etc.

H3ll0H3r31Am0x45

Answer 8

I was going through the same thought in my mind and I came up with asdff3F#, asdffF3#, asdff9F(, asdffF9(, etc.

I considered the following:

1. We place left hand fingers on asdf, using the same characters for alphabets will help us in no displacement of left hand.
2. Using right little finger to click shift.
3. Displacement is minimum if we move middle finger of either hand (I can reach 3 with left middle finger and 9 on right middle finger).