Specialty · SecurityLesson 4 of 9Free to read

Brute force in numbers · Cyber Security Basics

How long would it take to guess a password?

Why you need it

Password rules like "one capital, one digit, one symbol" are everywhere, but they don't always make passwords harder to guess. A little arithmetic shows what really matters, so you can write sensible password checks and pick good passwords yourself.

The intuition

Think of a bike lock with 3 dials of 10 digits: 10 × 10 × 10 = 1,000 combinations. Each extra dial multiplies the work by 10.

A password works the same way. If each character can be one of size symbols and the password has length characters, there are size ** length possible passwords: the keyspace. On average an attacker finds it after trying half of them.

Adding length multiplies the keyspace again and again, while adding a few more kinds of symbols only makes each dial a bit bigger. That's why a long passphrase of plain words can beat a short password full of symbols.

Definition

Keyspace

The number of possible passwords: (number of possible characters) to the power of (length).

Brute force

Trying every possible password in turn. The average time is keyspace ÷ 2 ÷ guesses per second.

Examples

Size of the keyspace

Try it yourself

26 lowercase letters, or 94 printable characters on a keyboard.

lower = 26
any_char = 94
print(lower ** 8)
print(any_char ** 8)
print(lower ** 12)

Step by step

L38 lowercase letters: about 209 billion passwords.208827064576
L48 characters of any kind: about 30 times more per position... and 30,000 times more in total.6095689385410816
L512 lowercase letters beat 8 characters of any kind.95428956661682176

Turn it into days

Try it yourself

Suppose an attacker can try 10 billion guesses per second against a fast, unsalted hash. That number is an assumption for the example.

rate = 10_000_000_000
cases = [("8 lowercase", 26, 8), ("8 any", 94, 8), ("16 lowercase", 26, 16)]
for name, size, length in cases:
    seconds = size ** length / 2 / rate
    print(name, round(seconds / 86400, 1), "days")

Step by step

L1Underscores in numbers are only for reading: 10_000 is 10000.
L4Average time: half the keyspace divided by the speed.
L586400 seconds in a day.

Common mistakes

Complexity instead of length

P@ssw0rd! follows every symbol rule and is in every attacker's word list. Length and randomness matter more than swapping a for @.

A strong password used twice

When one site leaks, attackers try the same email and password everywhere else. A password manager lets every site have its own random password.

Quick quiz

1. What does this print?

1
2
3

pin_digits = 10
print(pin_digits ** 4)
print(pin_digits ** 6 // pin_digits ** 4)

A
```
10000
100
```
B
```
40
2
```
C
```
10000
2
```

Show the answer

Answer: A

A 4-digit PIN has 10⁴ = 10,000 options. Two more digits multiply that by 100.

2. Which password has the bigger keyspace?

A`Tr0ub4d&` (8 characters, any of 94)
B`correct horse battery staple` (28 characters, 26 letters plus space)

Show the answer

Answer: B

94⁸ is about 6 × 10¹⁵; 27²⁸ is about 1 × 10⁴⁰. Length wins by a huge margin (as long as the words are chosen at random).

Practice

3 exercises in three steps: predict what a program prints, change a program to meet a new requirement, then write one from scratch. Your code runs in the browser and is checked the moment you submit.

PredictRead the rules
Type exactly what this program prints.
ModifyA better password check
problems(pw) only checks the length. Add two more rules, in this order, after the length rule:
- if the password has no digit at all, add "no digit"
- if the password, in lowercase, is in COMMON, add "common"
WriteDays to crack
Write crack_days(size, length, rate) that returns the average number of days a brute-force attack needs, rounded to 1 decimal place:
average seconds = size ** length ÷ 2 ÷ rate, and one day has 86400 seconds.

Practise this lesson

Open the interactive lesson to edit and run these examples and solve the exercises with instant feedback. Free to start, no sign-up.

Open the interactive lesson Course map

Interactive lessons open in order. If you have not done the earlier ones yet, you start at the course map.

Terms in this lesson

Term	Chinese	Definition
Keyspace	密钥空间	The number of possible passwords or keys.
Brute force	暴力破解	Trying every possible password until one works.
Passphrase	密码短语	A long password made of several random words.
Password manager	密码管理器	An app that creates and stores a different random password for every site.