I'm only taking about security against bruteforce attacks.

I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the programming), as randomly guessing, storing the list of guesses, generating a new random guess, checking it against the list of old guesses and trying if it hasn't been guessed would be inefficient. Also, ZZZZZZZZZZ is very unlikely to be in a dictionary attack.

Using that logic, wouldn't ZZZZZZZZZZ be the most secure password out of all passwords that are 10 or less characters?

  • That's one way of doing it, you also attach a weight to each password, so that "password" is first, maybe throw in some randomization into which one is next
    – TruthOf42
    Apr 14, 2014 at 19:01
  • But ZZZZZZZZZZ wouldn't be in a word-list for a dictionary attack.
    – Jon
    Apr 14, 2014 at 19:02
  • 4
    That assumes that the attacker behaves like you proposed. What if they start with a random password, run until ZZZ jump to aaa until they're at the start? Apr 14, 2014 at 19:04
  • @chipperyman573: I just checked in my big list of previously leaked passwords that I would use in a penetration test as a word-list against hashed passwords. "ZZZZZZZZZZ" is in there, so if you chose that and I had your password hash, I'd break it in considerably less than a second in the pre-cracked passwords run.
    – Matt
    Apr 15, 2014 at 1:58
  • Possible extension of the question: does it make sense for a random password to have a non-random first character (since 0, 1, a, A, z, Z would probably be brute forced early, hence reducing the time it takes for a strong password)?
    – domen
    Apr 15, 2014 at 8:44

3 Answers 3


The attacker is in your head. By this I mean that the attacker knows you and knows your password generation strategies. If you systematically use passwords beginning with a 'Z', then he will start his search with such passwords. (Especially since you have described this very method on a publicly readable Web site.)

You might have an edge if you choose your passwords differently from everybody else; but attackers adapt, and adapt fast. Choosing 'ZZZZZZZZZZ' as password is strong only as long as attackers try potential passwords in alphabetical order; and attackers have already stopped doing that. They first try passwords with "structure", such as ten repetitions of the same letter, because that's a kind of passwords that human users choose (then they continue with derivations from common words and names).

It is hard to outsmart attackers; it is especially hard to know how much you outsmarted attackers, because smartness is not something that is readily quantified and measured. The normal stance is to assume that the attackers knows everything about your password generation process, save the random choices within that process; this is the only way you can reliably estimate the strength of your password.

Regardless of how you choose your password, an attacker who is intent on trying all possible letter combinations can always generate these combinations in a random order, which guarantees him the theoretical average success rate of N/2 (if there are N possible passwords, he will try on average half of them before hitting the right one). There is no password generation method which can be used to prevent that.


The assumption that password crackers go from a to ZZZZZZZZZZ is probably incorrect. Password crackers have evolved to use much more complex techniques that extend to using markov chains etc. To get a better idea of what professionals do when attemting to crack a password read this great article:

Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”

Even in the case where they did enumerate from a to ZZZZZZZZ it should not take a pro long to get to ZZZZZZZZZZ given the processing power they have at their disposal and the limited length and key space of the example you provided.

  • "it should not take a pro long to get to ZZZZZZZZZZ" this is it, the bottom line is that if they are bruteforceing it (cracking a hash), it may take a bit longer to get to ZZZZZZZZZZ than AAAAAAAAAA but they will get there before too long anyway.
    – Jeff Meden
    May 13, 2016 at 19:38

Only the most simple bruteforce would work that way. A much better use of your time would be to add an extra character.

If you go here http://calc.opensecurityresearch.com/ there is a calculator that demonstrates how much password length matters. For example, using only upper/lower case alpha, md5, a 10 character password takes 531 years to brute force. A 11 character password takes 27652 years under the same conditions.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .