# If bruteforcing a password goes aaa, AAA, aab, AAB, etc, all the way to ZZZ, wouldn't ZZZZZZ be the most secure password?

I'm only taking about security against bruteforce attacks.

I assume that most crackers start at a and go up to zzzzzzz for as long as instructed (so it could be zzzzzzzzzzz if told so in the programming), as randomly guessing, storing the list of guesses, generating a new random guess, checking it against the list of old guesses and trying if it hasn't been guessed would be inefficient. Also, ZZZZZZZZZZ is very unlikely to be in a dictionary attack.

Using that logic, wouldn't ZZZZZZZZZZ be the most secure password out of all passwords that are 10 or less characters?

• That's one way of doing it, you also attach a weight to each password, so that "password" is first, maybe throw in some randomization into which one is next Apr 14 '14 at 19:01
• But ZZZZZZZZZZ wouldn't be in a word-list for a dictionary attack.
– Jon
Apr 14 '14 at 19:02
• That assumes that the attacker behaves like you proposed. What if they start with a random password, run until ZZZ jump to aaa until they're at the start? Apr 14 '14 at 19:04
• @chipperyman573: I just checked in my big list of previously leaked passwords that I would use in a penetration test as a word-list against hashed passwords. "ZZZZZZZZZZ" is in there, so if you chose that and I had your password hash, I'd break it in considerably less than a second in the pre-cracked passwords run.
– Matt
Apr 15 '14 at 1:58
• Possible extension of the question: does it make sense for a random password to have a non-random first character (since 0, 1, a, A, z, Z would probably be brute forced early, hence reducing the time it takes for a strong password)? Apr 15 '14 at 8:44

The attacker is in your head. By this I mean that the attacker knows you and knows your password generation strategies. If you systematically use passwords beginning with a 'Z', then he will start his search with such passwords. (Especially since you have described this very method on a publicly readable Web site.)

You might have an edge if you choose your passwords differently from everybody else; but attackers adapt, and adapt fast. Choosing 'ZZZZZZZZZZ' as password is strong only as long as attackers try potential passwords in alphabetical order; and attackers have already stopped doing that. They first try passwords with "structure", such as ten repetitions of the same letter, because that's a kind of passwords that human users choose (then they continue with derivations from common words and names).

It is hard to outsmart attackers; it is especially hard to know how much you outsmarted attackers, because smartness is not something that is readily quantified and measured. The normal stance is to assume that the attackers knows everything about your password generation process, save the random choices within that process; this is the only way you can reliably estimate the strength of your password.

Regardless of how you choose your password, an attacker who is intent on trying all possible letter combinations can always generate these combinations in a random order, which guarantees him the theoretical average success rate of N/2 (if there are N possible passwords, he will try on average half of them before hitting the right one). There is no password generation method which can be used to prevent that.

The assumption that password crackers go from a to ZZZZZZZZZZ is probably incorrect. Password crackers have evolved to use much more complex techniques that extend to using markov chains etc. To get a better idea of what professionals do when attemting to crack a password read this great article: