I have a question. If you were using a password brute force/dictionary attack utility on a site like yahoo or another site, how long would it take to crack a password like Jah13Wootiang if Wootiang is first name and Jah is last name? This is assuming that attacker knows your name.

This is assuming that there is no lock feature.

closed as too broad by tylerl, Adi, Rory Alsop Sep 2 '14 at 6:32

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


It is completely subjective and thus not a question that is easily answerable.

What I mean by this is that it all depends on a what approach the cracker takes. If it is a simple sequential brute force through the key space at one thousand guesses per second then it would take a very long long time to crack since iterating through that key space and testing each combination of the letters and numbers will take approximately 64.65 billion centuries.

But, and this is a big but, given that we know password crackers don't use simple brute force techniques very often this will most likely not be the case. Password crackers make use of much more intelligent and complex targeted techniques that involve massive dictionaries of breached passwords and word lists ans well as rainbow tables and even statistical techniques involving Markov chains to make the guessing of password a much more intelligent process making it less of simple a shot in the dark.

This means that if the attacker had you name and surname they could probably guess your password in a significantly shorter span of time (a few hours to a few days) using different combinations of your name and surname structured strategically. You password should never be constructed from some combination of personally identifiable data that is there to be seen by all.

If you were thinking of using a password like this, don't! Your password should ideally be a reasonably long sequence of random numbers, letters and special characters that are of no significance to you and does not represent natural language and names or surnames in any way.

  • Does the attacker here mean a person with great knowledge or normal person? – passs Sep 2 '14 at 5:40
  • The attacker has to be someone that is motivated enough to want to get your password, has an internet connection that gives him/her access to all of the knowledge and resources and has some free time. So, yes it's not impossible for a "normal" person to do this if they are motivated enough. – ilikebeets Sep 2 '14 at 5:58

If the attacker is performing a targeted attack (ie. they are going after a certain account and have researched the account owner), the password you gave is probably going to be among the first few hundred guesses, and certainly among the first few thousand. "Last name + numeric infix + first name" is a common pattern, although infixes are less common than prefixes or suffixes.

If the attacker is performing an untargeted attack (ie. they want an account, and don't care whose account it is), the password you gave won't be guessed. The attacker will simply try a few of the most common passwords and move on to the next account. When 1.5% of users pick "123456" as their password, an attacker is better off trying one password on a hundred accounts than trying a hundred passwords on one account.

Not the answer you're looking for? Browse other questions tagged or ask your own question.