When creating a new password, people often recommend you use both uppercase and lowercase characters, numbers, and symbols. How does adding any of these increase the strength of a password?

There are 26 lowercase alphabet characters. Lets assume that there are 100 characters in the entire group of capitalized alphabet characters, symbols, and numbers. Now let's look at any password of length 6. There are (26 + 100) ^ 6 possible passwords of length 6. A hacker would have a [1 / (26 + 100)] ^ 6 chance of guessing such a password. The hacker has no way to tell if you used only lowercase alphabet characters or you mixed lowercase alphabet characters with special characters, so he must guess with the entire sample space on each character. If, however, he knew you were only using lowercase alphabet, then, yes, the probablity of guessing your password would increase to (1 / 26) ^ 6. But in the real world, a hacker wouldn't be able to figure which set of characters you used.


Your assumption is that attacker password guesses are uniformly distributed among the domain of potential passwords. This assumption is incorrect: guesses are skewed toward more likely passwords, which are lower-case dictionary words as those are easiest for users to type and to remember.

The benefit of using a complex password then is that it will probably take a longer time for the attacker to try your password as a guess. Incidentally, when considering a large multi-user system, the "no need to outrun the lion" rules apply and in many cases a good password is one that's more complex than another user's. That is not always true if an attacker is specifically targeting you rather than the system.

  • Is a non-dictionary all lowercase password just as safe as a recommended password? For example, is "jbezlqw" as safe as "JbE$1qW"? – JoJo Jun 13 '11 at 15:25
  • 1
    Who's doing the attacking? That's the point, it depends on what the attacker tries. – user185 Jun 13 '11 at 16:07
  • Well, the problem is no.one knows what the attacker will try. Likewise, the attacker doesn't know anyone's character set. If lowercase dictionary words are the only trick, then anything outside of this characterset is equally likely to occur. – JoJo Jun 13 '11 at 16:57

If you have complex password, there is a chance that it won't be decoded when potential hacker downloads the database of users from server. Simple password stored as MD5 or other hash could be easily found in some hash database (on the other hand, even complex password could have matching hash collision too).

It is much faster to perform lowercase, 6 letter brute force attack on few thousands users hoping at least few passwords will be revealed, than trying to brute force one user using all the characters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.