0

Okay, I guess it's not possible to call one-letter-passwords "secure" - so let's compare ZZZZZZZZZZ with aaaaaaaaaa.

Both are using the same character pool [A-z], so the number of combinations for a password with ten characters is 56^10 = 144 quadrillion. According to HowSecureIsMyPassword, this could be brute-forced in about one year.

How are "common" brute force tools (I only know Jack the Ripper) implemented? Do they start with a, trying everything up to z, and then start again with A? Or are they starting with the most frequently used character e to the least used z?

Assuming they would: how big would be the difference to calculate aaaaaaaaaa vs ZZZZZZZZZZ?