# How does the password become 30,000 times stronger?

This google support page says:

For example, an eight-character password with numbers, symbols and mixed-case letters is harder to guess because it has 30,000 times as many possible combinations than an eight-character password with only lower case letters.

How does this 30,000 figure come? Why is it so high?

Password entropy is exponential and my math may be off a bit, but you'll get the point.

There are 26 letters so an 8 character password has 268 (208,827,064,576) possibilities. If you add in capital letters (another 26) numbers (another 10) and symbols (another 10 or so depending on how obscure the symbols are) we're up to 728 (722,204,136,308,736) possible combinations. Increasing the length of the password increases the exponent so having a 10 character password would be 7210.

My math doesn't quite work out to 30,000 times stronger, but there are more than 10 symbols and I think the point is made as to how password strength grows so fast.

• does your math suggest something more than 30000? – user80723 Jul 10 '15 at 19:27
• 722,204,136,308,736 / 208,827,064,576 = 3458.3837.... as I said there are more than 10 symbols (about 30 on my keyboard) that would increase the possibilities to 92^8 (5,132,188,731,375,616). 5,132,188,731,375,616 / 208,827,064,576 = 24576.2623... so getting there. – JekwA Jul 10 '15 at 19:33
• @JekwA Using 7-bit ASCII, I count `127-32=95` printable characters. Minus 10 digits and 52 letters (uppercase and lowercase), you get 33 special characters, which includes space. Excluding space you have 32 special characters. Both get close to 30,000 (one above, one below). – Luc Jul 10 '15 at 19:43

Say we have a computer with which we can try 1 password per second. If we make an 8-character password with:

• numbers (10 options);
• symbols (33 options); and
• mixed-case letters (`26 × 2 = 52` options),

we can construct `(10 + 33 + 52) ^ 8` (to the power of eight) different passwords, such as `m{xL9FUh` or `b9d:9F?.`. Thus it takes that many seconds to try all possibilities if we want to crack it.

Now if we have only lower case letters, 26 options, we can only make `26 ^ 8` different passwords, such as `ccqzcqld` or `tpotmykq`. To crack these we only need `26 ^ 8` seconds to try all possibilities.

`(10 + 33 + 52) ^ 8 = 6634204312890625`
`(26) ^ 8 = 208827064576`
`6634204312890625 / 208827064576 = 31769` (close to 30,000)

It depends how many symbols you can make, for example if you count characters like é and ö, then you have a lot more different characters. Usually we count only the printable, 7-bit ASCII set. If space is excluded as symbol, then the resulting difference is 29,190 (closer to 30,000).

• I am no expert on this, just curious; does the time for a computer to try out passwords which uses only lower case letters vary from trying ones with mixed ones? (I know that you assumed 1 password/second just for simplicity) – user80723 Jul 10 '15 at 19:36
• No, the characters used do not impact the time it takes to "try" them. – JekwA Jul 10 '15 at 19:39
• @user80723 No, it's just ones and zeros to the computer. The byte `00111000` (which we read as `8`) is the same to a computer as the byte `00100001` (which we read as `!`). – Luc Jul 10 '15 at 19:40