# Why are lengthy passwords stronger than complex ones? [duplicate]

So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to make for more secure passwords. Now I understand that some password strength checkers can be bogus or not very accurate so I'm hoping someone can shed some light on whether or not length is more secure than complexity and why. Here's the password I'm testing:

`this password is supposed to be weak and easy to crack but its strong`

• All Lower Case
• Dictionary Words
• 69 Characters Long

Each of these websites says that my password is very strong. I realize this makes a password hard to brute force but what I don't understand is how this make it secure from things like dictionary attacks since it's all lower case and all dictionary words. Is it accounting for the human factor?

Obligatory XKCD Comic

• This may be a duplicate of this earlier question: security.stackexchange.com/q/6095/12 Apr 28, 2013 at 20:16
• The xkcd inspired question should answer this completely :-) Apr 28, 2013 at 20:46

Simply because exponential growth is much faster than polynomial growth.

For a password which has a fixed length `n`, where the number of characters in your character set (`x`) is variable will give you a complexity of xn.

This is a polynomial function, and grows accordingly as `x` is increased.

On the other hand, fixing the character set to `n` and keeping the number of characters `x` variable gives you exponential growth nx. This increases much faster as x is increases. (Compare the derivateves for reasonable values of `x` and `n` if you wish)

Basically, for reasonable values of `x` and `n`, increasing `x` is much more effective in increasing complexity in the second case.

This is why the strength checkers say that it is secure.

However, using dictionary words does open it wide for dictionary attacks, which can be less secure. Try to use a few random strings in there as well.

• @Howdy_McGee: Well, yeah. 2^x represents exponential growth (which is generalized to n^x) Apr 28, 2013 at 21:31
• If the attacker knows that a password is composed only of correctly spelled lower case English words, then you don't have to attack character by character. You attack word by word. Apr 29, 2013 at 4:00
• @Zoredache: I know, that's why the last line is there. Apr 29, 2013 at 4:16
• @Zoredache In such a case, you can think of the dictionary of possible words as the "character set" and the number of words as the "number of characters". Provided you use enough words (something like 4-8 words depending on your threat model) that can still be a really good approach. (Yes, I know your comment is really old, just adding some additional info). Mar 7, 2019 at 17:20