I've been told/seen online that choosing a sentence or a phrase from a book and using it as a password is a bad idea. How is this true? Unless the potential attacker knew which book you used I don't see how this isn't basically a brute force problem. In which case an random sentence of at least 24 characters should be impossible to crack, no?


Yes, it is a bad idea. The number of books in the world is quite finite, and efficient password cracking software can make billions of guesses per second against an offline password hash. It is not at all difficult to try every single possible combination of phrases in every single digitized book in the world.

The length of the sentence itself doesn't matter either. This is because an attacker will be taking entire sentences and phrases at once and hashing them. They will not try to brute force it from scratch.

  • I'm curious, what kind of system that still allow brute-force attack? my phone/computer will lock me after a few wrong inputs. – qsp Nov 18 '18 at 5:56
  • 6
    @qsp Offline attacks, for example, if you get a copy of the *nix shadow file, the Windows NTDS.dit file, or capture password hashes off the network via LLMNR or Kerberoasting. – gowenfawr Nov 18 '18 at 6:09
  • The number of digits, letters and words are also quite finite. Number of books finite is incorrect as well - we won't be running out of books anytime soon. – McMatty Nov 19 '18 at 1:42
  • Hey great answer! Very helpful, I've been trying to learn more about password cracking and relating tooling recently. Do you happen to know of any particularly good resources describing the architecture in more detail? Thanks! – securityOrange Nov 19 '18 at 2:30
  • @securityOrange Well you're on Information Security! If you have any specific questions, you can certainly ask them. I'm not sure about any resources for password cracking though, but I think the Hashcat forums are good. – forest Nov 19 '18 at 7:37

The reason this could be considered bad is that the search space is smaller

  • Sentences have a structure they must adhere to - making rule based brute force simple
  • Popularity of books make creating a word list easy. Top 100 books of all time, the bible
  • Books are personal - so any information about yourself can help reduce the books to look at
  • There is roughly 12500 sentences per book - sentences are not going to be unique per book

That said this only really matters if an attacker knows you use a book otherwise your password will be treated like every other one.

  • 2
    I agree with all but the last sentence. If I am cracking a bunch of hashes and I'm not getting lots of results, I will certainly switch to cracking based on phrases from literature, even if I am not sure that my target is doing that. It's a very common technique, so it's common in cracking rulesets. – forest Nov 19 '18 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.