# Why are Lengthy Password Stronger Than Complex? [duplicate]

So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for more secure passwords. Now I understand that some Password Strength Checkers can be bogus or not very accurate so I'm hoping someone can shed some light on whether or not length is more secure than complexity and why. Here's the password I'm testing:

`this password is supposed to be weak and easy to crack but its strong`

• All Lower Case
• Dictionary Words
• 69 Characters Long

Each of these website say that my password is very strong. I realize this makes a password hard to brute force but what I don't understand is how this make it secure from things like dictionary attacks since it's all lower case and all dictionary words. Is it accounting for the human factor?

Obligatory XKCD Comic

-

## marked as duplicate by Rory Alsop♦Apr 28 '13 at 20:45

This may be a duplicate of this earlier question: security.stackexchange.com/q/6095/12 – Xander Apr 28 '13 at 20:16
The xkcd inspired question should answer this completely :-) – Rory Alsop Apr 28 '13 at 20:46

Simply because exponential growth is much faster than polynomial growth.

For a password which has a fixed length `n`, where the number of characters in your character set (`x`) is variable will give you a complexity of xn.

This is a polynomial function, and grows accordingly as `x` is increased.

On the other hand, fixing the character set to `n` and keeping the number of characters `x` variable gives you exponential growth nx. This increases much faster as x is increases. (Compare the derivateves for reasonable values of `x` and `n` if you wish)

Basically, for reasonable values of `x` and `n`, increasing `x` is much more effective in increasing complexity in the second case.

This is why the strength checkers say that it is secure.

However, using dictionary words does open it wide for dictionary attacks, which can be less secure. Try to use a few random strings in there as well.

-
@Howdy_McGee: Well, yeah. 2^x represents exponential growth (which is generalized to n^x) – Manishearth Apr 28 '13 at 21:31
If the attacker knows that a password is composed only of correctly spelled lower case English words, then you don't have to attack character by character. You attack word by word. – Zoredache Apr 29 '13 at 4:00
@Zoredache: I know, that's why the last line is there. – Manishearth Apr 29 '13 at 4:16