Let's assume person A chooses 15 words for a passphrase with an average length of 5. The passphrase meets following conditions.

Word conditions:

  1. The first word is not a valid word and can't be found in any dictionary. It's twice the length of the average word and meets all conditions for a well password.
  2. Word n=2 until word n=7 are not random, created by person.
  3. Word n=8 until word n=15 are truly randomly generated.
  4. All valid words are coming from 3 different languages.

Further conditions:

  1. 4 random special characters are mixed into the passphrase at random position.
  2. 4 digits are mixed into the passphrase at random position.
  3. One letter is capitalized.
  4. All words separated by space.

I understand that:

  1. The not valid word increases probably the security with increasing length, because it's like a password.
  2. The not random part decreases the security with increasing length.
  3. The truly randomly generated part increases the security with increasing length.
  4. The usage of multiple languages increases the search space.
  5. Points 5-7 increase the security, if chosen truly randomly.

What I want to know is: How to rate the overall security of this passphrase?

Because the security can still be dramatically increased or decreased through a combination of this parts.

Scenario 1: Person B doesn't know anything about the creation.

Scenario 2: Person B has partial knowledge of the passphrase:

  1. That the first word isn't a word.
  2. That there must be a random and a not random part.
  3. That the words are coming from different languages.
  4. That there are digits and special characters are mixed in.
  5. That the passphrase may contain capitals and they may be separated.

Maybe more, if I forgot something.

Scenario 3: Person B knows everything about the creation rules of the unknown passphrase.

How would Person B proceed in the various scenarios and what would be the overall outcome of their efforts?


3 Answers 3


Consider alternatives

Security does not necessarily correlate with entropy. If a password is too complex, it cannot be memorized and many users may write it down. A potential attacker can easily see the password without any brute-forcing.

See what NIST say about it in the document NIST SP 800-63B, chapter A.3.

Highly complex memorized secrets introduce a new potential vulnerability: they are less likely to be memorable, and it is more likely that they will be written down or stored electronically in an unsafe manner.

As a result, users often work around these restrictions in a way that is counterproductive...

You suggest that users will chose words 1 - 7. But according to NIST it makes your passphrase weaker:

... composition rules are commonly used in an attempt to increase the difficulty of guessing user-chosen passwords. Research has shown, however, that users respond in very predictable ways...

Users’ password choices are very predictable...

The random part of your passphrase is better. NIST says about it:

Secrets that are randomly chosen ... and are uniformly distributed will be more difficult to guess or brute-force attack than user-chosen secret...

Thus, NIST does not recommend complex passwords. How can you reach security then? NIST has an answer:

Password length has been found to be a primary factor in characterizing password strength.

In this document NIST recommends entropy of at least 112 bits. Means, take some simple algorithm and make the passphrase so long that it gives 112 bits entropy. Examples:

  • If password consists of randomly chosen English low case letters, it should be at least 24 characters long: 2624 = 2113, means 113 bits entropy.
  • If you use random words out of Diceware dictionary, 7776 words, the password should consist of at least 9 words, which gives 116 bits entropy.

If you still want to estimate entropy of your algorithm...

According to the Kerckhoffs's principle you should assume that an attacker knows everything about how the passphrase was generated. That's why it makes sense to consider only the 3rd case.

Any restriction reduces the number of possible passphrase candidates and thus reduces the entropy. That's why the attacker will try to apply all the known information.

  • Restriction for the average length of 5 means that the total length of the passphrase is 75. This means, the attacker will skip many word combinations because they give too short or too long passwords. The number of combinations depends on the language. For more then one language the principle remains the same.
  • Words 2 to 7 are not random, but chosen by a user. According to NIST (see above) it means low entropy. I would consider it negligible compared to the randomly generated part 8 - 15, and would not consider it in the calculation.
  • "4 random special characters...": The number of ways to pick up 4 of 75 positions is 75!/(4!*(75-4)!) = 1 215 450. The number of phase candidates should be multiplied by this number.
  • For 4 fixed positions of special characters, there can be N4 combinations, where N is the number of special characters. Multiply the result from previous steps by this number.
  • One of 75 letters is capitalized. Thus multiply the number of combinations by 75.

For this assignment, you should assume that:

  1. the attacker knows exactly how you are generating the passphrase, including the exact wordlist(s) that the words were selected from (Kerckhoffs' Principle);

  2. the method used to hash the password is worst case (a very fast hash like MD5), as this is often unknown or outside the control of the defender;

  3. there is a target level of capability of the attacker (say, a trillion hashes/second); and

  4. there is a desired period of time to resist attack (say, 10 years).

The security of the passphrase should be derived solely from A) the elements being chosen truly randomly, and B) the total number of possible combinations of elements. The sheer size of B) should be large enough to make brute force infeasible - perhaps on the order of 10^25 or more combinations, depending on assumed attacker capability and target resistance time.

Note also the "average" password will be cracked in half of the time it takes to exhaust the entire keyspace, so you might need to double your strength so that the average user meets or exceeds your target resistance time.

In other words: define your assumptions, then do the math of how many combinations of your passphrases are possible ... and you can answer your own question. :D

P.S. Your scheme is almost certainly very difficult for a human to memorize - which makes it likely that the goal isn't to support human memorization. And if not for humans, a simple random string of equivalent entropy / keyspace would be fine (and all of this complexity would be unnecessary). So this feels like an artificial problem.

  • Another good response. In fact, it's intended for human memory.
    – 127 001
    Mar 19, 2023 at 8:04
  • 1
    It will be extremely difficult to properly memorize. Having to remember the location of the numbers and special characters significantly increases the cognitive load. The user would be better served by simply increasing the size of the word pool, and adding a word or two until the target entropy / attack resistance is achieved. For example, if the word list is 20,000 words, each word increases the complexity by 20,000 times, increasing rapidly. As my answer says, it's all about the math. Mar 20, 2023 at 14:45

To quote a co-worker of mine: "It's always the people with the most secure passwords, who worry about their passwords not being secure enough."

To answer the question directly: Your passphrase is secure for all intents and purposes. If you want to know why, keep reading.

Scenario 1: No Previous Knowledge

This is the scenario, which is most likely. An attacker obtains a hash of your password in one way or another, and now tries to brute-force it.

15 words with an average word length of 5 means a 75 character long password. Even of all of that were lowercase and an attacker would try only lowercase characters, that would be 2675 or a bit more over 350 bits of security. That is enough security to never worry about computational power.

Even if an attacker would try various english words with rules that would just happen to coincide with your chosen capitalization, number substitution or other characteristics, the amount of available computing power would not suffice.

Furthermore, attackers don't need to crack all the passwords. 30% success rate is already extremely good. Remember, you just need to be a more difficult target than a user who's password is Spring2023.

Scenarios 2 and 3: Partial / Full Knowledge

These two are extremely similar, to the ppint where there is no meaningful difference. An attacker with full knowledge would likely see that this is fruitless and give up. This sounds like a cop-out, but cracking passwords has a cost associated with it.

For one, if you crack in the cloud, it takes a specific amount of money to try a specific amount of password hashes. Even on a "fast hash", this is rather expensive once you're trying to calculate a dodecillion hashes.

Even if you crack offline, you need to pay for electricity, and you could spend that computational power on other, more lucrative things as well.

So just from a viability perspective, an attacker, who knows how your passphrase is constructed, will see it's pointless to try and instead tries to attack some other hash. Even a nation-state actor would find it to be easier and more effective to try and install malware on your device instead than trying to crack this hash.

  • "that would be 26^75" - No. This statement is wrong. The letters are not random. They belong to words. This means essentially less possible combinations and thus essentially easier to brute-force.
    – mentallurg
    Mar 19, 2023 at 2:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .