This question already has an answer here:

I came across an interesting password policy online recently:

"Please be sure to enter a password that meets the following criteria:

  • must be 8 characters long
  • must not be based on dictionary words
  • must be different from previous 6 passwords
  • must contain at least 1 uppercase character (A-Z)
  • must contain at least 1 lowercase character (a-z)
  • must contain a leading letter (a-z or A-Z)
  • must contain at least 1 number (0-9)
  • may contain up to 2 special characters ($ or # only)
  • may not have repeating characters
  • must be different from user ID"

It seems to me that this narrows down the number of possible passwords so dramatically that it would take appropriately configured hackware all of two minutes to figure out someone's password. Is that approximately accurate?

marked as duplicate by Xander, Eric G, Steve, TildalWave, Iszi Apr 29 '14 at 16:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


You're right, it is a really interesting password policy. Some of those rules are poorly defined. If I apply a loose definition, I think it doesn't narrow the number of possible passwords to the point of making them easy to guess, but there are problems with this list:

  1. Best protection of password is the length. If it really must be exactly 8 characters, that is really bad. I assume they mean 8 characters or longer. 8 characters isn't enough anymore in my opinion (even though this is recommended as a minimum everywhere). Increase to 10 or 12.
  2. repeating characters? I assume they mean right next to one another Who cares? This doesn't do much to improve the guessability of a password.
  3. Why only two special characters? Why limit it to # or &?? This makes no sense.
  4. Leading Letter? Again, WHY?
  5. No dictionary passwords is something I agree with, but how are they verifying it? Do they have a database of dictionary words?

total possible combinations:
(26 + 26 + 10 +2) ^ 8 = 281,474,976,710,656 exclude combinations without numbers:
(26 + 26 +2) ^ 8 = 72,301,961,339,136 exclude combinations without leading letter:
(10 + 2) + (26 + 26 + 10 + 2) ^ 7 = 4,398,046,511,104 exclude combinations with repeating characters: total possible - (64! / 56!) = 103,011,989,072,896

exclude dictionary words (words with 8 letters) round up to 10,000

final answer of how many passwords allowed: 101,762,979,777,508 So about 102 Trillion

  • 2
    It means they aren't using a standard library for passwords but rolling their own. The restriction of $ and # confirms it. The repeating letters restriction is a 'feature' that the programmer thought up, so he does a very basic look-ahead search at each character to see if the next character is the same. The problem then is "what ELSE is poorly programmed in this security sub-system?" – schroeder Apr 25 '14 at 19:09
  • @mcgyver5: Per your questions: It's exactly eight characters, not 'or longer' (I tried.) No repeating characters ('pppp', etc.) means one less character to test in each position. As for the rest, you've got me! :) – Bill Horvath Apr 25 '14 at 19:18
  • 1
    Well, that is even goofier than I thought. A length restriction might mean they aren't even hashing the passwords. – mcgyver5 Apr 25 '14 at 19:39
  • 1
    @mcgyver5 Agreed, and the password field on the database is hard-coded at 8 chars (so, old). – schroeder Apr 25 '14 at 20:55
  • Any idea how long it would take to test the combinations? – Bill Horvath Apr 25 '14 at 22:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.