# Password Testing Sites. Am I being Paranoid? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [September 3, 2012, 1:19pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535 "2012-09-03T13:19:17Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![SiXSwordS](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@SiXSwordS](https://boards.straightdope.com/u/SiXSwordS)\ **Post date:** [September 3, 2012, 1:19pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/1 "2012-09-03T13:19:17Z")
It’s easy to find sites that test the strength of your password(s). (e.g.:[http://howsecureismypassword.net/](http://howsecureismypassword.net/)) The first time I heard of one, I thought, “What a great scam!” Just ask people to input their passwords and you’ll “test” the strength of said password. But a password is only as strong as it is well protected. Hell, I could break into Fort Knox if they give me the key. Even if there are genuine, ethically-run sites, isn’t it likely that someone will develop a site–or has already developed a site–that captures the tested password for nefarious purposes? Please rate responses on a scale of one to five tinfoil hats, as to how paranoid I am. Also, please include your password(s) and the rating received from the link above. ---
**Author:** ![Flyer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/flyer/32/7298_2.png) [@Flyer](https://boards.straightdope.com/u/Flyer)\ **Post date:** [September 3, 2012, 3:30pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/2 "2012-09-03T15:30:10Z")
Between bank websites, email websites, and messageboards, (not to mention all the places that require a password to post comments), how in the world would they know what website the password is for? They would have to (successfully) send you a keylogger and a malicious cookie and then match what you gave them with all the websites you visit. That’s a lot of work compared to simply hacking a national corporation that fails to properly protect its customers’ sensitive information. I would give you 5 tin-foil hats, and suggest that you input a test password that follows the same pattern as your real one. I used “dj2323” which is a password I use on a couple of unimportant websites, and got this rating: It would take a desktop PC about 0.544195584 seconds to crack your password. ---
**Author:** ![SiXSwordS](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@SiXSwordS](https://boards.straightdope.com/u/SiXSwordS)\ **Post date:** [September 3, 2012, 4:02pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/3 "2012-09-03T16:02:14Z")
> [@Flyer](#): > > I would give you 5 tin-foil hats, and suggest that you input a test password that follows the same pattern as your real one. Woo-Hoo! I tried _Talwsatgiglz4_ a got the response: It would take a desktop PC about A million years to crack your password. Of course they now have my password for all the porn site chat rooms I frequent. Good thing they don’t have my username: Dixon Crotchholl. edited for racy content ---
**Author:** ![Nawth\_Chucka](https://avatars.discourse-cdn.com/v4/letter/n/c57346/32.png) [@Nawth\_Chucka](https://boards.straightdope.com/u/Nawth_Chucka)\ **Post date:** [September 3, 2012, 4:07pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/4 "2012-09-03T16:07:44Z")
I agree, 5 hats for the OP. My configuration would take 344,000 years to crack, according to the site above. ---
**Author:** ![ratatoskK](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ratatoskk/32/2987_2.png) [@ratatoskK](https://boards.straightdope.com/u/ratatoskK)\ **Post date:** [September 3, 2012, 4:07pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/5 "2012-09-03T16:07:57Z")
I would never use such a site. Just make something with some special characters, numbers, and mixed-case letters, with nothing repeating or sequential, and that’s long enough. It can still be cracked but that’s all you can do. A web site has nothing to add. ---
**Author:** ![Nametag](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/nametag/32/406_2.png) [@Nametag](https://boards.straightdope.com/u/Nametag)\ **Post date:** [September 3, 2012, 4:13pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/6 "2012-09-03T16:13:23Z")
The problem with these sites is that their calculations are bullshit. Despite a statement that “Your password looks like it could be a dictionary word or a name,” the site you mentioned cannot distinguish between words and random letter strings. Substituting a number into an eight-letter word buys you 11 minutes; capitalizing it gets you 3 hours; adding both gets you 15 hours; a symbol nets 33 minutes, but adding it to the above – 3 days. Does anyone really believe that Sexier@7 is 5000 times as secure as ftyromba? ---
**Author:** ![VanillaGorilla](https://avatars.discourse-cdn.com/v4/letter/v/f9ae1b/32.png) [@VanillaGorilla](https://boards.straightdope.com/u/VanillaGorilla)\ **Post date:** [September 4, 2012, 7:00am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/7 "2012-09-04T07:00:37Z")
Good news. The password _!äÖå"ö3Å%nÄb?å(ö&äÄ3Ö8_ would take a desktop PC 257 octillion years to crack. Surely I will have changed my password by then anyway. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [September 4, 2012, 8:04am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/8 "2012-09-04T08:04:15Z")
That site’s not very good, it doesn’t really test for dictionary words. I saw a better link here on the SDMB, but I can’t recall it now. Anyway, I don’t think you’re paranoid, I wonder the same thing. In fact I wonder why people don’t create free forums and chatrooms to mine passwords? ---
**Author:** ![Molotok](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@Molotok](https://boards.straightdope.com/u/Molotok)\ **Post date:** [September 4, 2012, 8:16am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/9 "2012-09-04T08:16:01Z")
> [@AaronX](#): > > \ > > Anyway, I don’t think you’re paranoid, I wonder the same thing. In fact I wonder why people don’t create free forums and chatrooms to mine passwords? (underlining mine). We’re onto you, ‘‘Cecil’’. :mad: ---
**Author:** ![AClockworkMelon](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aclockworkmelon/32/10803_2.png) [@AClockworkMelon](https://boards.straightdope.com/u/AClockworkMelon)\ **Post date:** [September 4, 2012, 8:23am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/10 "2012-09-04T08:23:32Z")
I got 2 trillion years for one of mine. ---
**Author:** ![kferr](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kferr](https://boards.straightdope.com/u/kferr)\ **Post date:** [September 4, 2012, 11:40am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/11 "2012-09-04T11:40:39Z")
Obligatory [XKCD](http://xkcd.com/936/) link. ---
**Author:** ![SiXSwordS](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@SiXSwordS](https://boards.straightdope.com/u/SiXSwordS)\ **Post date:** [September 4, 2012, 12:09pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/12 "2012-09-04T12:09:35Z")
> [@kferr](#): > > Obligatory [XKCD](http://xkcd.com/936/) link. I love that XKCD. There are several sites I visit that have password rules (must use one capital, between 6-8 letter must use one $%\*? etc etc.). I’ve compared some of my own passwords to the pws I have to come up with for their sites and mine are better. I think I picked up my strategy here. Take some phrase or lyric or poem or whatever and use the first letter of each word. I usually add some numbers as well. towamfnwdwslhcsihswagahwohcimnwacicfi995610 …gets a 66 quindecillion years rating from the linked site (I agree that that site is not necessarily a true test of password strength) and its just a common limerick with the number of syllables in each line appended. Easy to remember _and_ you get a chuckle every time you enter it. ETA: correctbatteryhorsestaple gets a quintillionyears. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [September 4, 2012, 8:12pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/13 "2012-09-04T20:12:54Z")
If you feel like using the site, don’t give it your password but a similar one. For example if your password was fsmith234 give it pjones473. Give it something with the same composition (same length if possibe), just different letters/numbers. ---
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [September 4, 2012, 8:44pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/14 "2012-09-04T20:44:55Z")
I put in my SMDB password. 5 quintillion years. If I start posting spam links in the next few days, the OP was right and it stole my password. 🙂 ---
**Author:** ![FatBaldGuy](https://avatars.discourse-cdn.com/v4/letter/f/ecd19e/32.png) [@FatBaldGuy](https://boards.straightdope.com/u/FatBaldGuy)\ **Post date:** [September 4, 2012, 9:43pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/15 "2012-09-04T21:43:43Z")
What good would it do for a site like this to harvest passwords? The password is no good without[ol] [li]A website address[/li][li]A user name[/li][/ol] If all you enter is your password, they won’t be able to use it unless they know what sites you frequent. ---
**Author:** ![Enderw24](https://avatars.discourse-cdn.com/v4/letter/e/ba9def/32.png) [@Enderw24](https://boards.straightdope.com/u/Enderw24)\ **Post date:** [September 4, 2012, 9:53pm UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/16 "2012-09-04T21:53:09Z")
It would take a desktop PC about A tresvigintillion years to crack your password Yes! Three tittilated virgins. That’s a pretty powerful password. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [September 5, 2012, 12:39am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/17 "2012-09-05T00:39:56Z")
> [@VanillaGorilla](#): > > Good news. The password _!äÖå"ö3Å%nÄb?å(ö&äÄ3Ö8_ would take a desktop PC 257 octillion years to crack. Surely I will have changed my password by then anyway. I’m guessing you’ll change it on or about the first time you manage to (or fail to) log in. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [September 5, 2012, 12:51am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/18 "2012-09-05T00:51:02Z")
> [@FatBaldGuy](#): > > What good would it do for a site like this to harvest passwords? To improve dictionaries and rainbow tables. Which does contribute to the likelihood of your account being hacked at some point in the future. Especially if you reuse passwords, or similar passwords. OP is paranoid, but rightly so. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [September 5, 2012, 2:00am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/19 "2012-09-05T02:00:43Z")
> [@FatBaldGuy](#): > > What good would it do for a site like this to harvest passwords? > > The password is no good without[ol] > [li]A website address[/li][li]A user name[/li][/ol] > > If all you enter is your password, they won’t be able to use it unless they know what sites you frequent. This = the password test site, or This = SDMB? SDMB already has your email. With emails and passwords, you could try Facebook, Amazon and iTunes, and I’m sure plenty of passwords would work. ---
**Author:** ![core\_dump](https://avatars.discourse-cdn.com/v4/letter/c/dec6dc/32.png) [@core\_dump](https://boards.straightdope.com/u/core_dump)\ **Post date:** [September 5, 2012, 4:38am UTC](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535/20 "2012-09-05T04:38:24Z")
> [@tellyworth](#): > > To improve dictionaries and rainbow tables. This is precisely what it’s for. And I’d like to add: If I was the site operator I’ve also logged your IP when you gave me your password. Got any services running on your box that are reachable from outside? My automated process is sure gonna find out in short order. Remote desktop or SSH would be great goodies. [Next page](https://boards.straightdope.com/t/password-testing-sites-am-i-being-paranoid/633535.md?page=2)