-3

This google support page says:

For example, an eight-character password with numbers, symbols and mixed-case letters is harder to guess because it has 30,000 times as many possible combinations than an eight-character password with only lower case letters.

How does this 30,000 figure come? Why is it so high?

2

Password entropy is exponential and my math may be off a bit, but you'll get the point.

There are 26 letters so an 8 character password has 268 (208,827,064,576) possibilities. If you add in capital letters (another 26) numbers (another 10) and symbols (another 10 or so depending on how obscure the symbols are) we're up to 728 (722,204,136,308,736) possible combinations. Increasing the length of the password increases the exponent so having a 10 character password would be 7210.

My math doesn't quite work out to 30,000 times stronger, but there are more than 10 symbols and I think the point is made as to how password strength grows so fast.

  • does your math suggest something more than 30000? – user80723 Jul 10 '15 at 19:27
  • 722,204,136,308,736 / 208,827,064,576 = 3458.3837.... as I said there are more than 10 symbols (about 30 on my keyboard) that would increase the possibilities to 92^8 (5,132,188,731,375,616). 5,132,188,731,375,616 / 208,827,064,576 = 24576.2623... so getting there. – JekwA Jul 10 '15 at 19:33
  • 1
    @JekwA Using 7-bit ASCII, I count 127-32=95 printable characters. Minus 10 digits and 52 letters (uppercase and lowercase), you get 33 special characters, which includes space. Excluding space you have 32 special characters. Both get close to 30,000 (one above, one below). – Luc Jul 10 '15 at 19:43
0

Say we have a computer with which we can try 1 password per second. If we make an 8-character password with:

  • numbers (10 options);
  • symbols (33 options); and
  • mixed-case letters (26 × 2 = 52 options),

we can construct (10 + 33 + 52) ^ 8 (to the power of eight) different passwords, such as m{xL9FUh or b9d:9F?.. Thus it takes that many seconds to try all possibilities if we want to crack it.

Now if we have only lower case letters, 26 options, we can only make 26 ^ 8 different passwords, such as ccqzcqld or tpotmykq. To crack these we only need 26 ^ 8 seconds to try all possibilities.

(10 + 33 + 52) ^ 8 = 6634204312890625
(26) ^ 8 = 208827064576
6634204312890625 / 208827064576 = 31769 (close to 30,000)

It depends how many symbols you can make, for example if you count characters like é and ö, then you have a lot more different characters. Usually we count only the printable, 7-bit ASCII set. If space is excluded as symbol, then the resulting difference is 29,190 (closer to 30,000).

  • I am no expert on this, just curious; does the time for a computer to try out passwords which uses only lower case letters vary from trying ones with mixed ones? (I know that you assumed 1 password/second just for simplicity) – user80723 Jul 10 '15 at 19:36
  • No, the characters used do not impact the time it takes to "try" them. – JekwA Jul 10 '15 at 19:39
  • @user80723 No, it's just ones and zeros to the computer. The byte 00111000 (which we read as 8) is the same to a computer as the byte 00100001 (which we read as !). – Luc Jul 10 '15 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.