enter image description here

Many of us are familiar with this comic. If I had a word like "catfish" and just repeated it an arbitrary amount of times, say n, it would be theoretically stronger. Wouldn't it?

One pitfall I could see is dictionary attacks with multiple values of n but it seems like this might not be ideal. What if picked a more arbitrary string like "ca4f1sh!"?

  • This only increases entropy a couple bits. Entropies only add when the parts are independent. Commented Apr 12, 2015 at 0:19

3 Answers 3


The problem with picking a password based on any pattern is that, if the attacker knows the pattern, they can then eliminate relatively large numbers of possible passwords they'd otherwise have to test.

This is why we advocate for passwords to be randomly-generated as much as possible. The only restrictions you might want to put on the random generation are:

  • Minimum character length
  • Inclusion of multiple character types

Those help to ensure (though, strictly, not guarantee) that the random generator will not unintentionally spit out a password that's likely to be found in dictionaries or rainbow tables. However, where it can be avoided, we do not want to add in restrictions like these:

  • Maximum character length
  • Exclusion of certain characters or character types
  • Matching specific patterns (e.g.: a dictionary word repeated n times - even if n is random)

These will greatly reduce the search space for an attacker who knows your password generation scheme. You might still be able to dodge the ones who are just looking through a database for passwords they can easily break. But you'll be much more vulnerable to a dedicated and resourceful attacker who is targeting you specifically (some call this an "Advanced Persistent Threat" or "APT"), or if your particular method becomes common among other users and the large-scale attackers adjust their methods to compensate.

True random generation of passwords, with very few restrictions to avoid accidental output of weak passwords, is the only way to be sure your password is strong enough to resist virtually any attacker. Of course, this all does assume that the password storage and transmission mechanisms are reasonably secure as well - but that's beyond the scope of this question.

In short: A password based on a single string repeated a number of times, is always more vulnerable to a dedicated attack than one which is of equal length and randomly generated throughout.


Repeating the word "catfish" multiple times would indeed make the password stronger than any single "catfish". Since there is no way to know that you repeated the word or by how many times it has been repeated it stands to reason that the password is indeed strong. As other explanations of the xkcd comic describe, if a random word group were chosen using a true random method it would be possible to have repeated words. The act of purposefully not repeating words actually lowers the security of the password since it is no longer truly random.


Theoretically that is a 'stronger' password against bruteforce methods than just a single catfish. But you also increase other risks:

Shoulder surfing - If an attacker spots you typing your password, even 'ca4f1sh!', over and over its pretty east to remember 7ish characters in a logical order and just go home and try accessing your gmail with a few repeated repetitions of 'ca4f1sh!'

Repeated Passwords - One of the absolute worst scenarios that this would make you more vulnerable to, although admittedly not likely, is a reverse rainbow table lookup where your password would have been used by someone else and cracked into a rainbow table. Not likely, but with simple repeated passwords its certainly possible and it only takes one dictionary.

So yes, it has higher entropy. But after a certain point the trade off for higher entropy is mitigated by the increased risks posed for other reasons. The best thing to do is come up with a great password for a password manager like KeePass and then use 15-20 randomized passwords for everything else.

For the 'great' password use an obscure quote and change it into a pass phrase - Here is the idea but you can find better guides elsewhere - http://www.fmcorey.com/2014/11/using-strong-passwords/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .