# Could letters alone in a longer password be just as strong as one with digits and specials?

When considering the strength (or secureness) of passwords and passphrases, where some can have a mix of letters of either case, numeric digits, punctuation characters, arithmetic operators, and any other character, and some are longer with just letters of one case, about how much longer is considered to be equally strong (or secure)? Is there some definite rule to figure the strength? How would the type of characters actually used compare against the type of characters that particular situation allows to be used? Does the strength of hashing affect the consideration of the set of characters that will be used? Does the used of Unicode or homoglyphs affect this consideration?

Would a 16 character password consisting only of lower case English letters be considered to be as strong as an 8 character password consisting of English letters of both cases, numeric digits, and special characters? Could letters alone in a longer password be just as strong as one with digits and specials?

Is there some definite rule to figure the strength?

Yes. You want to count how many possible passwords there are. The more possibilities there are, the better.

Would a 16 character password consisting only of lower case English letters be considered to be as strong as an 8 character password consisting of English letters of both cases, numeric digits, and special characters?

Here is how you can figure that out:

The number of only-lower-case letters is 26. This means there are \$26^{16}\$ possible 16 character passwords made of only lower case letters. (That notation is supposed to mean 26 to the power 16, sorry, not sure why the LaTex superscript isn't rendering.)

The total number of upper-case and lower-case letters and digits and symbols is about 94 (depending on how you count, but let's say 94). This means that there are \$94^8\$ possible 8 character passwords of this type.

Since \$26^{16}\$ (43608742899428874059776) is bigger than \$94^8\$ (6095689385410816) it is better to use a 16 character only-lowercase letter password.

Could letters alone in a longer password be just as strong as one with digits and specials?

Yes, as shown above.

• i worked out the ratio of only 12 lower case letters vs. 8 of the mix of 94 by typing in (26**12)/(94**8) to python3 in interactive mode and got greater than 15.655. i expect many combinations people just won't use such as "aaaaaaaaaaaa" and "++++++++", but i think the ultimate usage ratio will be about the same. Aug 14, 2018 at 1:33
• Yes, (26^12)/(94^8) is about 15.655. Yes, many of the possibilities will not be used. It is important that the number of possibilities be much much bigger than the number of passwords used in practice.
– hft
Aug 14, 2018 at 1:37
• so telling people that they should use some number of digits and/or specials is or is not getting them to use stronger passwords or just doing better at evading common guessing strategies? if evading guessing is the way to go then randomized lower case can sill be very strong regardless of what the system accepts or encourages. Aug 14, 2018 at 1:39
• I don't know. This seems like you are asking a related (but different) question from your original question. It would be best to just post this question as a new question since the moderators frown on extended discussion in the comments. (it is not as helpful for the community).
– hft
Aug 14, 2018 at 5:27

# The Basic idea

Yes, the concept you're looping around is "how many possible passwords exist under these rules?", which is formally called the "Password Space".

The formula to figure out how big the password space is for a given set of rules is quite simple:

• 16 character password consisting only of lower case English letters: there are 26 lowers, so:

26 ^ 16 = 4.4x10^22 possible passwords

• 8 character password consisting of English letters of both cases, numeric digits, and special characters: depends on how many special characters you allow, but lets say 26 lowers + 26 uppers + 10 digits + 16 specials = 78 characters, so

78 ^ 8 = 1.4x10^15 possible passwords

• Unicode: let's say there's around 100,000 valid unicode characters. Then you only need a 5 or 3 character password (respectively) to match the password spaces of lowers, and lowers, uppers, digits, specials.

but before we get too excited over these numbers ...

# Where it gets real

The number of possible passwords above is only really useful as a measure of security if every possible password is equally likely to be chosen. In my experience this is not true since graycat123 is a far more common password than h&9R#d3*ng (or ǨΞᾃЯ ҉ℒⵞ௵ޘ↡╤ if using the whole unicode space, but don't ask me how to type that on an Android keyboard!)

This very quickly gets into psychology and user-habits and we often see stats like this:

SplashData estimates almost 10% of people have used at least one of the 25 worst passwords on this year’s list, and nearly 3% of people have used the worst password, 123456.

That's why you see more and more websites giving "password strength meters" next to the Change Password box -- these are checking your password against common lists, looking for dictionary words, looking for keyboard patterns, etc. These meters are a far better measure of password strength than just the length because, well, people are bad at choosing passwords.

Far better to use a password manager and let a machine choose your password so that h&9R#d3*ng is just as likely as graycat123. If you want passwords that you can remember, then a good option is to come up with passwords using the diceware trick.

• indeed if you tell people to use digits and they do so, they are using a smaller password space. if the system rejects passwords without at least 4 characters that are digits or specials then it only accepts an even smaller password space. but such a system may have the effect on users of discouraging common words among those digits and specials. Aug 14, 2018 at 1:20
• Yup! Although when you do the math, it turns out that any password space that you lose via "you must have a letter" type restrictions is dramatically smaller than what you gain by increasing the length by one. So people don't tend to worry about it. All assuming that people are not dumb and just adding a 1 to the end of whatever was rejected. Aug 14, 2018 at 1:24