# Known Password Lengths and security considerations [duplicate]

Many people wil often brag about the length of their password, like "yeah nobody is ever going to crack my password cause its 22 characters long." I was thinking, if you knew the exact length of their password, you could essentially lower the space and calculations necessary to brute force their password. My question is, does anyone know by how much does it reduce?

If I KNOW that a password is 22 characters in length, obviously you are not going to try any potential password that is not 22 characters in length.

tl;dr How much faster is it to crack a password if you know the exact char length?

If we assume that there are 128 possible characters in a password (2^7), then there are 2^154 possible 22 character passwords.

There are 2^147 + 2^140 + ... shorter passwords, which is pretty much the same as 2^147. So you have to do 1/128th less work if you know it's 22 characters and so don't have to try all the 1-21 character passwords first -- less than 1% less work, and not really significant.

• Your answer is generally correct. (cracking slightly shorter passwords truly takes less time than cracking the full length) However, most people do not use 128 possible characters in their password. Primarily this is because the standard US keyboard supports only 95 characters. (62 letters/numbers, 33 other characters) Commented Jul 19, 2016 at 12:12

See ophcrack rainbow tables. This will give you a good idea of how save passwords are for particular length and how set of used character make it more secure.

You can think: the bigger rainbow table must be to crack the passwords, the safer the password is.

Note, that making a password even one character longer makes it much longer to crack, so checking checking only `n`-long passwords compared to checking `1`-long, `2`-long, ... `n-1`-long, `n`-long does not really make much difference.