Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?

As an example, take a simple for loop in Go: fori:=1;i<5;i++{fmt.Println(i)}

Normal people would only see the cryptic syntax, but as a person with a programming background, this may be more easy to memorize. Would it be at least as secure as a normal password?


7 Answers 7


You can use source code as password.

However I'd strongly recommend against using source code as a passphrase.
The reason for this is entropy.
Passwords / passwphrases need to provide lots of entropy (100 bits+) and programming languages usually pose severe constraints on the formulation of instruction thus resulting in less entropy per character than even with a standard passphrase.

What may be possible aside of that, you can use source code files (100 lines+) with lots of complex instructions and non machine-codable as keyfile.

  • 6
    I'm not sure that it is really as bad as you think. From an information theoretic standpoint, this is nothing more than changing the alphabet of possible characters. In the example above it's approximately equivalent to an 8 character all lower case password, assuming that the attacker knows the password generation algorithm. See xkcd.com/936 while this isn't as good as correct staple horse battery, it is easier to remember than Tr0ub4dor&3 yet allow you to jump through "special character hoops". Commented Apr 10, 2015 at 14:08
  • 1
    You could strengthen it a little by using really weird variable names... Commented Apr 10, 2015 at 14:35
  • 2
    @S.L.Barth, but then you'd be back at a standard passphrase.
    – SEJPM
    Commented Apr 10, 2015 at 18:19
  • 4
    @Lawtonfogle I think that you hit the nail on the head. We shouldn't be measuring passwords based only upon entropy, but rather based upon entropy and 'meatspace difficulty'. I particularly like that phrase. Commented Apr 10, 2015 at 18:35
  • 3
    Grammatically-correct English has an entropy of around 1.5 bits per character, so to get the target entropy of 100 bits, you're looking at a 67-character passphrase. I suspect programming languages, with their stricter syntax requirements, have an even lower per-character entropy. (This is, of course, ignoring TECO and the like.)
    – Mark
    Commented Apr 10, 2015 at 23:51

Like most password generation algorithms, this one relies on security through obscurity.

As long as nobody suspects that you use this method, nobody will use a cracking tool which tries random valid source code snippets and the rule of strength = possible_characters ^ number_of_characters will stay valid. But as soon as someone suspects that you might be using it, or when it even becomes a common method because you start advertising it as "a very good idea" on a website, this would change.

As soon as someone feels compelled to write a tailored cracking routine, you have to look at how much entropy there really is in your sourcecode. And when you are limited to "small, memorable code snippet in common programming language", you are maybe down to a few billion possible passphrases, which is not enough to withstand a serious brute-force attempt.

  • 2
    Exactly. And you can never know whether your shiny new idea is independently (secretly) used by many others, and good password crackers may know much more about the psychology of choosing passwords than you do. Whatever clever trick you use, the attacker may predict it. Therefore you need to disconnect the choice entirely from anything predictable about you (i.e. use randomness). Then even if they correctly predict your decision, they can only conclude that you tend to choose random passwords.
    – isarandi
    Commented Apr 11, 2015 at 21:31
  • Not sure you're saying this is a bad idea, but as it prevents all the huge security problems of password managers I guess it's not a bad idea comparing the difficulty to remember to the 'external entropy' even if the 'internal entropy' is quite low. Commented Apr 11, 2015 at 23:45
  • The entropy of the attacking method can't be lower than the entropy of your generation method. Therefore having a high entropy generation method gives you peace of mind. Commented Apr 12, 2015 at 0:12

It's best to use a method that would stay secure even if everyone used it. You'll have less to worry about and it lets you collaborate with others in tweaking the method to be the most secure, because you don't have to keep your methods secret.

This "the enemy knows the system" approach is a huge motor for innovation and advancement in information security. Otherwise you'd have independent groups that each work on their own obscure, supposedly unexpected designs and principles.

Furthermore, you have no way to quantify how secure your system is because it all depends on psychology and what others know about you.

In some walks of life you need to be creative and build your strategy on some personal, unique insight that you have to keep secret, but information security is not like that.

  • Indeed, ideally you would remember all random per-user unique generated password by hard, but realistically you can't. So either you make the passwords easier to remember or you store them somewhere. The second option is dangerous as it creates a very easily attackable point (e.g. a password manager, intercepting the user accessing his pass store once results in full identity theft), so with passwords (unlike many other things) obscurity is to some extent an important requirement. Commented Apr 11, 2015 at 23:50
  • 1
    @DavidMulder I thought we are already talking about the master password, since password reuse is a big no-no anyway. Anyway, my usual strategy is to first generate a random password and then memorize it by making up some poem or expression that fits it. It's quite remarkable how much pattern you can find in any random string. For example, freshly from random.org: "pYmQ3xmKMy". I could say "pYthon may queue three times more Key Managers, why?". If you do this to the first password that you generate, you lose no entropy (only if you repeatedly regenerate for easier memorization).
    – isarandi
    Commented Apr 12, 2015 at 0:28
  • If you're able to memorize tens and tens of passwords that way: my respects. If however you are only able to remember a handful and store the rest in some kind of password manager then that's a risk you are willing to take. Commented Apr 12, 2015 at 8:56

At first glance, this seems like it might be a good idea. Like many suggestions relating to passwords, in some situations it may even be an OK solution. However, when you consider it in more detail, a number of shortfalls become evident.

If I was trying to crack someones password, one of the first things I would do is try to find out as much information about the person as possible. If I know you are a programmer, then I may well take a guess that you use some code for your passphrase. I've now narrowed down the possible search space.

If I know what your preferred programming language is, I've now reduced the search space even further. I only need to consider legal forms from your preferred language.

Now when I consider the legal forms which are allowed in your preferred language, I've reduced the search space even further. If there is a known maximum character limit for the passphrase, that search space is even smaller again - in fact, for most languages, there will only be a very small set of possible legal forms which will fit in to the allowed character limits for many passwords.

As indicated by other answers, the real problem with 'clever' password/passphrase schemes is that they rely on others not being able to guess what your scheme is. As the popularity of a scheme increases, the benefit of that scheme reduces. Above all, any scheme you choose needs to be something which is not easily associated with you.

The other problem with clever password schemes is that they are rarely as clever as you think theyy are. If you analyse passwords dumped from stolen password repositories, you will be surprised how 'common' many of these clever schemes are. You may also be surprised how often the clever scheme is related to the domain the passwords came from. For example, I saw passwords stolen from an Air Force system and guess what, the vast majority of passwords were either derivations of various aircraft names and model numbers or character names from movies or books with a military or air force theme. Likewise, passwords dumped a couple of years ago from a christian dating sight had large numbers of passwords which included phrases, chapter and verse numbers from the bible. If I was going to try and crack github passwords, I would almost certainly look at code as a possible pattern.

The one minor benefit of using code is that you will likely have a longer password/passphrase, which is often as important or more important as the underlying complexity. Too often, people use short passwords because they are easy and quick to type. These days, I think most people are far better off ensuring that they use either 2 factor authentication or 2 step authentication whenever possible and use a password manager which will generate random passwords for you and in most cases, eliminate your need to remember them.


TLDR; The entropy of one Code-Token is 4 Bit, which is way to less

I'm actually confused, that no one tried to measure the entropy of code, it's actually very easy. I used this Python-code:

import os
from os.path import join
from multiset import Multiset
import re
import math

with open("keywords.txt", mode="r") as f:
    keywords = f.read().split("\n")
tokens = Multiset()
split_regex = re.compile(r"\s+")
for path, folders, files in os.walk("vscode"):
    for file in files:
        if file.endswith(".ts"):
            filepath = join(path, file)
            with open(filepath, mode="r", encoding="utf-8") as f:
                content = f.read()
            split_res = split_regex.split(content)
            keywords_res = [keyword for keyword in split_res if keyword in keywords]
            tokens += Multiset(keywords_res)
total_nr = sum(tokens.values())
total_tokens = len(tokens.values())
print(total_nr, total_tokens)
assert total_nr > total_tokens
total_entropy = 0
for value in tokens.values():
    p = value / total_nr
    total_entropy += -p * math.log2(p)

it gave me an entropy of exactly 4.047718782037269 (keep in mind limited machine precision) on the Code of VS-Code with the following keywordlist:


of the following commit: https://github.com/microsoft/vscode/commit/c5702cdc190d0026457f43ae547cf66a1a15b7dd`` at first, I calculated the entropy without the whitelist but it contained a lot of comments and variable names and I got 12 Bits of Entropy. I don't think it makes sense to include them, because there are no naming rules which makes it easy to remember, then you could immediately use a usual password.

Keep in mind, that this is just an upper bound because there are more rules. My calculation assumes the keywords are coming independent from each other, which they are not.


Use Malbolge. After all that's essentially random, right?


That's the hello world program.

  • This doesn't really answer the question.
    – Mark
    Commented Apr 11, 2015 at 21:13
  • as there are very few programs in malbolge and they are all publicly known this would be a very bad choice. First you wouldn't have much entropy (not many programs, as soon as the source gets known). Second, the point of the question was to use easy-memorizable source code, but malbolge code can be memorized as easy as a standard random password, making it essentially an inferior choice. (due to the low entropy)
    – SEJPM
    Commented Apr 11, 2015 at 21:15
  • Malbolge doesn't has a predictable syntax though. @SOJPM If you would write your own program, I would assume its safe
    – Tom
    Commented Apr 12, 2015 at 9:52

This is actually a very good idea. You won't find this kind of passwords easely in rainbowtables, and most bruteforce attacks don't include characters like this or search for such long passwords.

Its only weakness is the fact that it is a short code (not a short password), if someone knows you have a script as password it could be easy for them to guess. This is assumed by above answer by SOJPM.

  • Why downvoted??
    – Tom
    Commented Apr 10, 2015 at 12:52
  • 8
    I'm not the downvoter, but: if this catches on, scripts will be added to rainbow tables soon enough. Commented Apr 10, 2015 at 14:45
  • If people globally know that you're using programming languages as password, it is of course not that safe anymore. You could prevent this by putting a password in the code but then we're back to square one.
    – Tom
    Commented Apr 10, 2015 at 15:52
  • arstechnica.com/security/2013/10/…
    – Chloe
    Commented Apr 10, 2015 at 21:44
  • 2
    @Tom, your assumption is that preposition A: "it is a good password because few people use it" will not lead to preposition B: "because it is a good password, many people will use it". IMO that assumption is not often the valid. Commented Apr 11, 2015 at 0:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .