# Does this create a strong password? **URL:** \ **Category:** Factual Questions\ **Created:** [August 28, 2012, 3:22pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932 "2012-08-28T15:22:03Z")\ **Posts on this page:** 7\ **Page:** 2
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [August 29, 2012, 1:11pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/21 "2012-08-29T13:11:06Z")
> [@Machine\_Elf](#): > > The thing that will save you is systems that limit the number of attempts before they call for a time out. This is nearly all systems, at least in practice. Network latency will probably limit you to a few hundred guesses a second at most. It’s the leaked password hashes (of which there have been a number of recent cases) that are the problem, because crackers can put them on different hardware and get many, many more guesses per second in. ---
**Author:** ![AdamF](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/adamf/32/6246_2.png) [@AdamF](https://boards.straightdope.com/u/AdamF)\ **Post date:** [August 29, 2012, 2:05pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/22 "2012-08-29T14:05:02Z")
> [@Machine\_Elf](#): > > However, if the brute-force method makes no assumptions and attempts to guess the password as a string of individual characters, then 15 characters means there are 2^15 possible combinations; Actually, these are characters, not bits. Theoretically, ASCII allows at least 200 different characters, giving you 3e34 combinations. In practice, you can limit it to lower and upper case letters, numbers and a few symbols - giving about 80 possible characters and 4e28 combinations. This is still a lot more work than a dictionary attack. ---
**Author:** ![tim314](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tim314/32/3468_2.png) [@tim314](https://boards.straightdope.com/u/tim314)\ **Post date:** [August 29, 2012, 2:34pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/23 "2012-08-29T14:34:35Z")
> [@Ximenean](#): > > The general principle is that a password should be secure even if the attacker knows what scheme you used to construct it. That seems like a silly principle to me. How would an attacker know what scheme you used to construct your password, so long as it’s sufficiently uncommon (and you don’t go posting about it on the Internet)? It seems to me that a more reasonable principle would be “Your password should be secure against the sorts of attacks an attacker is actually likely to use.” Suppose my password was my full name written out with the Alpha-Bravo-Charlie alphabet. (e.g. _Tango-India-Mike-Three-One-Four_, but obviously my real name is much longer). That’s completely insecure if you know what I’m doing, but in practice I think it’s far less likely to be cracked than something like _C3cilRules!_ ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [August 29, 2012, 2:40pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/24 "2012-08-29T14:40:53Z")
One of the better password strength checkers is a side project from dropbox. The checker: [https://dl.dropbox.com/u/209/zxcvbn/test/index.html](https://dl.dropbox.com/u/209/zxcvbn/test/index.html) A discussion about how it works and the strength of passwords. [https://tech.dropbox.com/?p=165](https://tech.dropbox.com/?p=165) ---
**Author:** ![Dag\_Otto](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dag\_Otto](https://boards.straightdope.com/u/Dag_Otto)\ **Post date:** [August 30, 2012, 4:23am UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/25 "2012-08-30T04:23:59Z")
> [@Machine\_Elf](#): > > a brute-force method that is working with this scheme would take 123 billion years to crack, assuming 1000 attempts per second. 1000 per second? A cheap Timex digital watch probably has more processor power than that.🙂 [A PC running a single AMD Radeon HD7970 GPU, for instance, can try on average an astounding 8.2 billion password combinations each second, depending on the algorithm used to scramble them.](http://arstechnica.com/security/2012/08/passwords-under-assault/) (that’s from a story that is referenced in **ClevelandProud’s** link, but they show a hacker’s machine with eight 7970 cards). It may still take a long time, but it’s getting shorter all the time. That story is an interesting read, and I’ll be updating many of my passwords this weekend. ---
**Author:** ![black\_rabbit](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@black\_rabbit](https://boards.straightdope.com/u/black_rabbit)\ **Post date:** [August 30, 2012, 2:59pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/26 "2012-08-30T14:59:48Z")
> [@Machine\_Elf](#): > > The problem with really long passwords like that - even if they’re easy to remember - is that since your view of it is often obscured by the password entry window (you usually see dots or asterisks instead of the actual letters you’re typing), it can be difficult to enter the entire password without making any mistakes. Really? I’m typing this with my eyes closed. How am I doing? ---
**Author:** ![Rhythmdvl](https://avatars.discourse-cdn.com/v4/letter/r/85f322/32.png) [@Rhythmdvl](https://boards.straightdope.com/u/Rhythmdvl)\ **Post date:** [August 30, 2012, 3:19pm UTC](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932/27 "2012-08-30T15:19:07Z")
> [@black\_rabbit](#): > > Really? > > I’m typing this with my eyes closed. How am I doing? FTFY: U;n ttoubg tgus wutg nt ete;s ckised. Giw an u diubg\> [Previous page](https://boards.straightdope.com/t/does-this-create-a-strong-password/632932.md?page=1)