Could letters alone in a longer password be just as strong as one with digits and specials?

Question

When considering the strength (or secureness) of passwords and passphrases, where some can have a mix of letters of either case, numeric digits, punctuation characters, arithmetic operators, and any other character, and some are longer with just letters of one case, about how much longer is considered to be equally strong (or secure)? Is there some definite rule to figure the strength? How would the type of characters actually used compare against the type of characters that particular situation allows to be used? Does the strength of hashing affect the consideration of the set of characters that will be used? Does the used of Unicode or homoglyphs affect this consideration?

Would a 16 character password consisting only of lower case English letters be considered to be as strong as an 8 character password consisting of English letters of both cases, numeric digits, and special characters? Could letters alone in a longer password be just as strong as one with digits and specials?

Answer 1

Is there some definite rule to figure the strength?

Yes. You want to count how many possible passwords there are. The more possibilities there are, the better.

Would a 16 character password consisting only of lower case English letters be considered to be as strong as an 8 character password consisting of English letters of both cases, numeric digits, and special characters?

Here is how you can figure that out:

The number of only-lower-case letters is 26. This means there are $26^{16}$ possible 16 character passwords made of only lower case letters. (That notation is supposed to mean 26 to the power 16, sorry, not sure why the LaTex superscript isn't rendering.)

The total number of upper-case and lower-case letters and digits and symbols is about 94 (depending on how you count, but let's say 94). This means that there are $94^8$ possible 8 character passwords of this type.

Since $26^{16}$ (43608742899428874059776) is bigger than $94^8$ (6095689385410816) it is better to use a 16 character only-lowercase letter password.

Could letters alone in a longer password be just as strong as one with digits and specials?

Yes, as shown above.

Answer 2

The Basic idea

Yes, the concept you're looping around is "how many possible passwords exist under these rules?", which is formally called the "Password Space".

The formula to figure out how big the password space is for a given set of rules is quite simple:

(num_allowed_symbols) ^ (password_length)

Your examples:

• 16 character password consisting only of lower case English letters: there are 26 lowers, so:

  26 ^ 16 = 4.4x10^22 possible passwords

• 8 character password consisting of English letters of both cases, numeric digits, and special characters: depends on how many special characters you allow, but lets say 26 lowers + 26 uppers + 10 digits + 16 specials = 78 characters, so

  78 ^ 8 = 1.4x10^15 possible passwords

• Unicode: let's say there's around 100,000 valid unicode characters. Then you only need a 5 or 3 character password (respectively) to match the password spaces of lowers, and lowers, uppers, digits, specials.

but before we get too excited over these numbers ...

---

Where it gets real

The number of possible passwords above is only really useful as a measure of security if every possible password is equally likely to be chosen. In my experience this is not true since graycat123 is a far more common password than h&9R#d3*ng (or ǨΞᾃЯ ҉ℒⵞ௵ޘ↡╤ if using the whole unicode space, but don't ask me how to type that on an Android keyboard!)

This very quickly gets into psychology and user-habits and we often see stats like this:

SplashData estimates almost 10% of people have used at least one of the 25 worst passwords on this year’s list, and nearly 3% of people have used the worst password, 123456.

That's why you see more and more websites giving "password strength meters" next to the Change Password box -- these are checking your password against common lists, looking for dictionary words, looking for keyboard patterns, etc. These meters are a far better measure of password strength than just the length because, well, people are bad at choosing passwords.

Far better to use a password manager and let a machine choose your password so that h&9R#d3*ng is just as likely as graycat123. If you want passwords that you can remember, then a good option is to come up with passwords using the diceware trick.