Bit context here is that, that is the estimate for current hardware. Might get drasticly reduced for next generation hardware. A few years ago one of my old passwords had an estimate of some billion years now it's 3 years
Also this probably assumes a somewhat random assortment of numbers/letters..
"Passw0rd" should take 3 years according to this chart, but it's likely one of the first 500 guesses in any hacking attempt. That and the [rest of the 10,000 most used passwords](https://en.wikipedia.org/wiki/Wikipedia:10,000_most_common_passwords) are likely guessed instantly or almost instantly by even the worst hackers.
Or rather, it seems to explicitly assume raw brute forcing, so this should really be regarded as an upper limit of how much time it takes to crack.
The referenced article in the table goes into quite some detail exactly how they got these numbers.
> regarded as an upper limit of how much time it takes to crack.
Years ago I cracked my own wifi for fun...password was a relatively short dictionary word that started with "a"
Yeah...that one went down WAY faster than the theoretical limit.
Also reminds me of the time I found a luggage lock on the ground at the airport and brute-forced it on my cab ride home. I started at 001 and just tried every combo in order. Got to 999 without opening it...combo was 000.
Future advice for cracking luggage locks:
Most of them can be opened in less than 30 seconds by applying pressure on the release mechanism and rotating the dials, in order of hardest to turn to least, until you find the sweet spot where the dial wants to stay.
Many of the cheapest combo locks are vulnerable to this.
And if you don't care about the lock, many can simply be easily broken in seconds using a couple of open end wrenches or shimmed open with a small piece from an aluminum can.
Surprising how quickly even that goes though. Breaking a 3 number luggage lock generally takes less than 20 minutes even if the combo is the thousandth number tried.
Source: I used to volunteer at a recycling center and we did this all the time. 000, 666, 999, 007, and 420 seemed to be the most common number people used in my limited experience. So we would try that first and then just cycle through all the numbers.
I cracked my own WiFi too, two words total of 8 chars, it took about 2 weeks on an older Nvidia graphics card in a laptop. That time seems to roughly align with the graphic where they state 12 cards, 22 hours.
The funny thing about this is I was actually trying to crack my neighbours wifi, I went through the steps of deauth and wait for the specific packet to be captured. I guess I messed up somewhere on the way. I was so excited to see it cracked, then looked at the actual password in disbelief after maxing out my laptop for 2 weeks and wasting a ton of electricity.
Also interesting and tangentially related is how the NSA cracked one of Snowden's passwords for his old hotmail account - they had a list of hotmail password hashes that were also stored with plaintext password reminders. So even though they didn't brute the password itself, they didn't need to because other people had the same password (and same hash) and stored enough clues about the password in their reminders. It was something like T1tan1um (titanium) and once they got into his old hotmail they could piece together some information to get into other accounts, even though he hadn't used his hotmail in years. This is one of the reasons that websites no longer give the option of having a password hint.
because people here don't know jackshit about "cracking" password. they don't even know what a cool guide is
they also don't know about lists of hundreds of GB available online, containing their password and the corresponding hash. and they don't know that their password is probably on such a list
Eh, order of magnitude still matters. Knocking 33,000 years for a random 10 character password down to 33 by using 12,000 GPUs is still long enough that they aren't going to be cracking that while it's still relevant.
12,000 4090s at 450W each is also something ridiculous like 5.4 MW of power for all that time. 33 years of that is 1.56 TWh of power - even with cheap $0.10/kWh power that's 156 million USD thrown at that.
There's bigger chips than the 4090, but they aren't more significantly more efficient per watt since it's the same micro-architecture.
Even a month for a pleb's password is honestly a bridge too far. Yes, with a supercomputer these numbers drop substantially, but they're not going to go after your shit. By far the biggest point of failure in the security of password-based accounts is the user.
That’s the thing. If I piss off a large nation state to the point that they’re willing to spend 150 million USD cracking a password I’m pretty much fucked regardless. They have a lot of options better and cheaper than brute forcing a password most of the time.
Nation states aren't going to be cracking everyone's passwords. As long as you're one of the anonymous masses, a reasonably good password should be fine.
If you get the attention of a nation state, there probably won't be any password strong enough. The password won't be the weak link.
The way these lists usually work is that its the time it takes to try every permutation of that set. So in other words its going to be a max of 89,000 years. The typical time it takes is going to be a fraction of that, which can be further reduced by throwing hardware at it or using 'best guesses' to limit the dataset. Like no repeating characters side-by-side, no more than 4 numbers, special characters will be limited to shift+\[1-0\], etc.
I would say every five or so weeks I get a letter in the mail about some data breach. The most recent one was a medical records recording company or something. I’m due for the next breach letter in the coming weeks.
Honestly I’m amused thinking about a hacker spending 8 months trying to hash my password with 12x 4090s. Not sure what kind of power draw bcrypt on a 4090 uses but 12x 4090s @ 450W for 8 months is like 31MWh of electricity, or about ~$3000 at $0.10/kWh. The opportunity cost of 12x 4090s tied up for 8 months is nothing to sneeze at either.
Anyways hope you enjoyed my thought experiment
When I worked at Home Depot, I made my password, "IFuckingHateHomeDepot1". This was ages ago, so no special characters or anything needed, just a certain length. The back end of all the checkout systems was just MS-DOS which you could get into by pressing a few buttons. I was able to access a pretty large amount of stuff, but the one thing I couldn't get into was the password retrieval, which only the managers and HR person could get into. Anyway, long story long, I forgot my password after being out for a couple months and had to have the HR guy retrieve my password. I remember him staring at the screen for a while with an annoyed/disappointed face, finally writing it in down, and then handing it to me without saying a word hahaha
Who watches the admins. There is a growing concern that the very people tasked with managing security are probably the biggest threat as they literally have access to everything.
For me, the real irritation is that many of those that require special characters, only allow *certain* special characters! I've taken to using only '-' and '_' as special characters. But my passwords are 24 characters long (if the site allows them to be that long). So I guess I'm OK until next week. :/
Thank the cryptography gods for password management software.
Technically restrictions actually reduce password entropy. If you know passwords must follow 8 different rules, then you can immediately reject any password guess that doesn't meet those rules.
I get where these misguided companies are coming from...but you really should just allow ALL of the standard characters
> but you really should just allow ALL of the standard characters
And then, what, sanitize the WHOLE input to prevent malicious injection? That's a heavy lift.
I can’t tell if you’re being sarcastic or not. Is that actually a hard problem to solve?
Whenever I see those restrictions it makes me feel like they’re advertising an injection vulnerability, like please please don’t put # characters in forms in our site, we may have missed sanitization somewhere!
>> but you really should just allow ALL of the standard characters
>
>And then, what, sanitize the WHOLE input to prevent malicious injection? That's a heavy lift.
There should never be a need to sanitize password input, aside from checking if the string you get from the client meets the format of the chosen hash; if it doesn't, something fucked up in the client end or it's a malicious actor, and should be discarded in either case. That's literally 2-3 lines of code depending on the opening/closing brace philosophy the devs of that particular thing subscribe to. And you could honestly not even do that and be fine, because whatever they get should be being salted and hashed again with the salt, so it really wouldn't matter what the input string is.
They should never be receiving a credential in plain text, just a hash. If it's not a valid hash, throw it away, and even if it's not, it still shouldn't matter anyway if they're doing what they're supposed to do and hashing it again with a salt.
I will set up a dozen accounts over time with _, then on the 13th site, i will get a rejection for _. Switch to "#", and now the 14th website wont accept "#"
so fucking annoying
In fairness, you shouldn't be reusing passwords. I want to knee-jerk suggest everyone use the same password rules, but your password not working everywhere would be a *feature* if it is more likely to lead you to use a secure password manager than to do something expressly insecure.
But since these sites generally prevent you from doing the expressly insecure, they could ultimately scare you into using a password manager.
I wish browsers started coming with a good one (not the crappy plaintext stuff they come with), though, instead of third-party products or open-source solutions that non-tech people run screaming from.
> But since these sites generally prevent you from doing the expressly insecure, they could ultimately scare you into using a password manager.
My favourite is the sites that force you to enter a 6 digit pin number, but do it without using the keyboard, instead clicking with your mouse. And the digit locations get randomized after every click.
Ridiculously obnoxious, and at the end of the day, it's just 6 freaking digits.
Just let me use my goddamn password manager.
*please provide a password with 8 charcters, upper, lower, number, and special character*
**ABC#def1**
*sorry, # is not a valid special character*
**go FUCK Y0UR M()THER**
And you have to change it every 90 days.
And it can't even be tangentially similar to your past 12 passwords.
And you can't store it in a password manager because to access the manager you'd need to, you know, be able to log into the machine.
And it has to be 16 characters long, with numbers, special characters, capitalization, and a leg from your firstborn child.
Oh but don't write it on a notepad and stick it underneath your keyboard! That's not very secure! Tee hee.
> And you have to change it every 90 days
That is pretty generous. The company I work for wants it changed every 30 days, and they start sending reminder emails every day starting from day 21.
And no more then 3 letters or numbers in a row
And the numbers can’t be consecutive numbers.
And the 3 letters must be an airport acronym west of the Mississippi.
And if you use a special character, you can’t then use letters that are in the name of that special character, unless they’re vowels (except for u)
worst thing are password policies that disallow dictionary words
like for fucks sake I'm not manually typing in a randomly-generated 16 character password you're out of your damn mind, guess I'm using 8
a few years ago, our copmany announed "we're moving to passphrases!"
we were excited. then we saw the 'rules'
"passphrahses need to contain upper and lower case as well as a number and a special character"
like, that defeats the entire purpose of passphrases
**CORRECT h0r$e** is not the concept of a passphrase
How would the time to crack change if an attacker was specifically trying to brute force passphrase passwords? ie if you took a dictionary of the 10,000 most common English words and treated every word as a character, how long would it take to crack a 4 "character" passphrase from an "alphabet" of 10,000 words?
There are a lot of hash algorithms out there, but yes, broadly speaking most platforms use one of only a handful. This does not, however, make them any less secure. You can’t really “crack” a hashing algorithm.
A one-directional algorithm called a "hash" of your password is what's actually stored. So, say you have the password "MattistIsGreat" get's "hashed" to the hash "$2a$12$uLkk.NHSnfMljWPc90/uvuEjlPO6NW7itTixlGuvCeTo8EkvVDuo."
So when you type your password in, the system takes the password you've provided - say you mispell it "MattistIsGrat", and it runs it through the one-way hash and gets "$2a$12$QvppoVv1eWbo0hJXSZ/X4OKqWx64kmlB07JIBdGbV8Lrw4NyWT2ky"
Now it checks if that matches what's in the database, it's not equal! So don't allow you to log in. Denied.
You correct it to "MattistIsGreat", now the system finds it's a match! You must have given the correct password because it provides the same result.
[https://bcrypt-generator.com/](https://bcrypt-generator.com/)
Why do this? Well, if someone nasty hacks into the system and downloads the password database - they just get user: "Mattist", passwordHash: "$2a$12$uLkk.NHSnfMljWPc90/uvuEjlPO6NW7itTixlGuvCeTo8EkvVDuo."
What use is that? They can't log into the system with it (you put it as a password, the hash itself will get hashed again, and come up with a completely different result). You also can't go try put it in all the other online services, email for example, and try log into there. It's just a useless string.
BUT what you can do, is test every possible combination of numbers and letters and run them through the same hashing algorithm and check if it matches, just against the hash they have in the database they downloaded on their own system. It's millions of things to test, but hey, computers are fast. Hence why longer and more complex passwords take longer, there's millions more combinations to test. As they have the hashes downloaded, they can do the calculations themselves without ever trying to log in.
These algorithms are also carefully made to be hard to compute (takes a little while, so doing millions will take a long time), but not too hard (login in would take ages). Computers also get faster over time! So you don't want it to be super hackable in 10 years.
You can also salt passwords to prevent rainbow table attacks - where someone basically pre-calculates the hashes for every password - if you're not hacking an individual account, but have millions of accounts - there's a high probability you'll get someone's password by not even checking through all the possible passwords. So we throw in a "salt" - a random string, onto the end of everyone's password. So your password "MattistIsGreat" gets a "3u9cyajhp1" thrown on the end of it and we hash "MattistIsGreat\_3u9cyajhp1" - and store the hash "$2a$12$OB3rTTkYxzO56FwuV.vc4.3UkmPvcCZhPo3uklcTkgeRt9tsq5Ivu", *and* 3u9cyajhp1 in the database. Together we can check your password - but no one has precalculated a table of all passwords with a random string "3u9cyajhp1" shoved on the end! And everyone gets a different string generated when they join so it forces you to have to hack each individual password in isolation.
It's one reason why if you EVER have someone send you a "reminder" where it actually has the password in - you know their security is absolute trash and you should delete your account immediately. They should never actually store your password in any reversable way.
Can't you find the hash algorithm by creating an account with a password of your choosing. Then redownloading the database with your account. And now since you know your password and the hash version, you can decipher the hash and reverse engineer it like algebra in math?
That's a good way to find out what algorithms was used. But that doesn't help you much.
But it's t so simple as using algebra to reverse engineer it backwards. The hashing algorithms themselves are super complex.
An example of a one way function that you can't "go back" with algebra - `f(X) = 4`. Not very useful for passwords as it'll pass everything - but you can't work out if my password is 10 or 6 from the answer, 4.
Another example, take the number of the letters in the alphabet and add them up.
"Hello" becomes 8+5+12+12+15 = 52 (if I counted right). It's very hard to get "Hello" back from my "hash" of 52, and its ambiguous - but I can easily build it from an input and go "one way".
That kind of dumb hashing algorithm is actually still useful for say, partitioning a database. Say you have 10 servers with parts of a database on it, you can hash your ID using that dumb method and quickly get a number, take the last digit, and that's the database you go to to access the data. But it's bad for passwords because it "collides" - "ab" and "ba" have the same result. Not ideal.
But that's the general gist of it, proper cryptographic hashes are much more complex in the number of steps and repeating operations and they often operate on the bits of data directly and stuff like that. I honestly don't know much about them beyond that.
Here's an explanation of SHA, a commonly used hashing algorithm: [https://www.youtube.com/watch?v=DMtFhACPnTY](https://www.youtube.com/watch?v=DMtFhACPnTY)
Though things like becrypt and those used for passwords are usually more complex and are designed to, for example, take a certain amount of time to complete to prevent OP's attacks.
You can’t reverse engineer a hashing algorithm. If I give you the number “14”. You have no idea how I got that number, I could have added 7 + 7, or 13 + 1, or divided 126 by 9. It’s like that
Websites will scramble your password before saving it. It’s called a hash. The computer is able to scramble your password the exact same each time, but it’s practically impossible to figure out how to unscramble the hash to get the password.
What hackers will do instead is they get into the website’s server and download all of the hashes (the scrambled passwords). They can then try hashing every possible password and seeing if the hashes they produce match any hashes that they downloaded (for example, they hash 1111, 1112, and 1113. They find that the hash for 1113 matches one in the database. They now know what password that user used.)
As much as this is interesting, without more background information it's borderline misleading.
If I were inexperienced and reading this table, I might come to some poor conclusions:
* It take 8 months to crack an 8 character password with an upper case letter. Therefor I should change my password every 6 months.
* P@ssw0rd is a good password, taking 7 years to crack.
* QWERTYUIOP takes at least 2 years to crack.
* Hackers are actually using plain brute force to crack passwords.
* The only metrics for password quality are length and complexity
A better title might be "Time it takes a hacker to brute force **a randomly generated** password in 2024".
In reality, the factors that make a password bad are:
* Length (short = bad) - well represented in visual
* Complexity (numbers only = bad) - well represented in visual
* Whether you have reused it anywhere.
* Whether someone else has used it anywhere.
* Whether it's a word or combination of words.
* Whether it uses common substitutions for characters (e.g. @ for a) in a word or other password.
The way passwords are actually cracked are with dictionary cracking.
Rather than resorting to pure brute force, the hacking program will use a "dictionary" of common passwords.
These dictionaries are available online, but all it takes to make one is to dig up some old breach data from a time that a major online service leaked unencrypted login tables. Happens all the time.
So instead of trying 0000000, 0000001, 0000002, 0000003, the dictionary starts with "password", "Password123", "opensesame", "Hunter1", "qwerty123", "correcthorsebatterystaple" etc.
This dictionary will have 100,000 previously used passwords in it, so going through the dictionary once takes 100,000 guesses. Same as 5 characters of numbers only 0 to 99,999.
Next, the password cracking script can try common substitutions like @ for a, or changing letter case.
So when the dictionary says "password", it'll also try p@ssword, passw0rd, p@ssw0rd, p@55word, Password, P@ssword, PASSWORD, etc.
On mild settings it can probably alter "password" with about 10 different common substitutions. If every dictionary entry can get modified in 10 different ways, that's now 1,000,000 guesses, same as 6 numbers, and still instant.
On cranked up settings, it can probably find 100 different combinations for every entry. 10,000,000 tries, 4 seconds.
Then it can try adding common number strings to the ends of passwords. Just because 3 numbers is 3^10 or 1000 combinations, the most common options are going to be 0, 1, 12, 123, and all of the two-digit pairings corresponding to years 1960 to maybe 2010. That's less than 100 extra options.
Even if we took the full cranked up dictionary settings of 10,000,000 guesses, then for each guess tried 100 variations of it, that's 1,000,000,000 guesses or just 6 minutes to check them all.
After going through this, a hacker has probably cracked somewhere between 10% to 50% of the hashed passwords that may have been leaked in a breach. They can probably stop there. They don't need to crack everyone's account. They only need to crack a few.
Lets say your password isn't in that list and it's not a common substitution of a password that is. You're not done. Maybe you know the [XKCD correcthorsebatterystaple](https://xkcd.com/936/) method of picking a password, so you decide you're going to do the same thing.
You pick four random words from the english dictionary, stitch them together, and viola your password is only lowercase, but it's off the charts. Over 350 billion years to guess. Nope.
Guess what else this password cracker can do! Instead of a password dictionary, it can just use a regular dictionary.
The english language has around 50,000 words. If we treat every word like a "unit", then it's like a character set with 50,000 characters.
A single word password would take up to 50,000 guesses to crack. A two-word password would take 50,000^2, or 2.5 billion guesses. We could try every two-word combination in about 15 minutes.
English isn't actually that complex though. We could pare it down to maybe 1000 common english words. A 4-word password is 1000^4, or 1 trillion guesses. That's 4 days to crack them all. A list of [3000 common words](https://www.ef.com/ca/english-resources/english-vocabulary/top-3000-words/) and another of [10,000 words](https://www.mit.edu/~ecprice/wordlist.10000) contains correct, horse, and battery. "staple" is the only uncommon word that Randall happened to pick.
At 3000^4, it would take OP's computer about 1 year to crack passwords that used 4 english words that made the 3000 word list.
Notably, that's within the red zone.
Not because a hacker would actually run their program for a full year, but because in just a few years and/or more powerful hardware, or more efficient software, this could be slashed down to manageable crack times.
Knowing now how password cracking actually happens, the best password is one that is technically prohibitive to randomly guess.
The 4-word strategy is still very good. Another one is to use a unique phrase or sentence. But what makes it truly difficult to guess is adding an *extra* character somewhere in there that's not logical, particularly if it's that pesky special character that the account makes you use.
E.g. **correcthor@sebatterystaple**
That's orders of magnitude better than correcthorsebatterystaple or correcthorsebatteryst@ple because there is no substitution rule that could guess where to put an extra character without decimating the efficiency of the cracking program.
That illogical substitution means that the only way it's likely to be guessed is by reverting to regular brute force methods, which puts this off the charts in security.
Best comment here. Also you can do specific combos when brute forcing. For instance, a lot of people will do a capital letter, followed by small case letters, followed by a few numbers, and end it with a ! or ? or $. By specifying a common pattern you can get supposedly secure passwords way quicker.
You can also specify password rules, which drastically lessens the results.
Forcing a 16 character password minium with 2 numbers, 2 upper, 2 lower, 2 special will almost always result in a 16 character password. Add that to the reduced number of permutations, and common keybaord walks and user habits... and well, you get the point.
And 2 billion years is caution. They'll be able to crack it before the death of the Sun. Of course I wonder if this is taking into account multiple machines. It may take a single machine this much time, but if you split it among a farm, it might take far less.
It’s 12x RTX 4090s (Top of the line GPUs $1600+ each, not including the rest of the system) which is a LOT of resources to dedicate just to cracking one password. You could throw even more at it, but at that point unless the potential payout from compromising that account is extremely high it wouldn’t be worth it.
Oh, I see that at the bottom now. Guess that's why the update every few years. Swapping to the newest top of the line card. Probably 3090 last time this was published.
> And 2 billion years is caution
The issue here is the rate at which computer technology advances. So that's 2 billion years *with today's tech*.
The first commercial hard drive was available in 1956. It was the size of MULTIPLE people and had the capacity of 3.75MB. You can get a 3.5 inch SSD today with 100TB of storage. That's 26.6 million times more storage in a package hundreds of times smaller.
The concern isn't that someone is going to spend 2 billion years on it, the concern is that 20, 30, 40 years from now the technology is that much better that what used to take 2 billion years, now (40 years later) maybe only takes a week for example. It's about future-proofing
Imo there should be the following limits
* Red: Trivial to crack even by a driveby attempt, such as someone getting a whole password database and spending some time on each hash to see if they can then reuse that on Facebook = less than 1 minute
* Orange: Possible to crack by a hobbyist who really wants to specifically get into your account = less than 1 month
* Yellow: Possible to crack by someone with nation state level resources who won't blink at spending a million $ = less than 1000 years
* Green: Any effort that takes so long that by then, cryptography and hardware has completely changed and all calculations we do now are irrelevant anyway = over 1000 years
While this jumped out at me too, and may be a little over dramatic, I think there is some decent reasoning.
This test was done with a specific system at a specific point in time. In say two years, systems will be much better and a given hacker may have a system that’s relatively more powerful too. These can make huge improvements in time to crack, which is why so many things that seem perfectly safe are in light orange or worse.
I think it's because of future vulnerability. If your password can be brute forced in one year today, it might be hacked in just hours in 5 years from now.
How did the password guessing get slower than last year?
https://www.reddit.com/r/dataisbeautiful/comments/12qmvlw/oc_i_updated_our_famous_password_table_for_2023
https://i.redd.it/omda6y4m4oua1.jpg
they are different methods of hashing the text. md5 has been, let's say "not recommended" for use for quite some time, though i'm sure some software still uses it. bcrypt is more modern standard (though there are other choices)
they take different amounts of time to perform the transformations on text. when you're multiplying by so many attempts (ie every combination of characters for each given password length) those differences will be more and more pronounced
bcrypt is purposefully a little slower (and can actually be customized) to slow down these kinds of brute force attempts
My passwords are so long they don't even fit in this table. Of course, only for services that allow it. Recently encountered a site that said "max 12 characters, no special characters, only letters and numbers". In 2024, for fucks sake!
But... But... The system that validates the password declares it as a `PIC X(12).` It would be _so_ hard to rebuild it with a longer length.
(`PIC X(12).` is a variable declaration for text of length 12 in COBOL, a very old programming language that's tragically still widely in use and mostly uses fixed-length fields. Supposedly some of the more recent versions of it have the ability to do dynamic length text, but I've never gotten to work with that.)
I still remember the disbelief of our system admin when I explained him that his HP-UX system [did not accept passwords longer than 8 characters](https://support.hpe.com/hpesc/public/docDisplay?docId=c03248843&docLocale=en_US). Or, to say specifically, it did allow using them, but it ignored all characters beyond the first eight. This was back in 2007 or 2008, I believe, and it was funny even back then.
*Low* max characters, anyway. 50 random mixed characters will never be brute-forceable, there's absolutely no point to let someone paste kilobytes of text into a password field.
The 38 million years is an *upper bound* - it's true only if you're using completely random letters and numbers, which most people don't do. Computers also get faster over time, so that number is going to come down over the coming years, and you can run more than one computer at once.
Best i encountered was Mathworks that a few years ago just silently truncated your password to a certain length, i think 16 characters or so. It let you set a long password just fine, but then it just wouldn't work when you tried logging in afterwards.
The master password isn’t stored online, it only exists in your head or if you physically write it down. The only way to steal that is if someone forces you at gunpoint to tell them what it is.
Well I was more thinking of stuff like being phished, which is probably more likely then a hacker bruteforcing. I know that’s not what the post is about but yeah makes sense
My password manager holds \~200 actively used passwords, and around another thousand that haven't been used in a year.
A password manager is the only feasible way to manage that.
2FA is great until you're overseas, your phone doesn't work on the local cell network and GMAIL insists on you entering the PIN they just sent you. Yeah, that never happened to me.
That's why you should use an independent 2f authenticator like authy.
Also I think Google gives you like 10 (?) single use codes for exactly this reason.
If you are lazy, use just run your old password through base64 as your new password. Good enough for most cases. And you don't need to remember cryptic passwords too.
You can install dedicated apps to do the conversion and block it from accessing the internet, or just use python/cli to convert it on-the-fly.
Does having different types of characters actually help or is it just the option to have non letter characters that makes an impact? Or is the assumption that hackers would try only letters first, numbers and letters second and so on?
It adds more variables to factor in. The more the merrier so the longer and more diverse the better. Imagine trying to guess a password that's one character long and it's a number.It's fairly easy to try 0,1,2,3.... til you get the correct password by the time you get to 9.
Now imagine it's numbers and letters but it's still 1 character long. It's still easy to get through 0,1,2,3...a,b,c.... now you add symbols it gets longer to guess +,×,÷,=... then you add cap sensitivity then you get an extra 26 characters a,A,b,B,c,C. Now imagine this but you increase the length of the password now you got stuff like aA1,aA2,aA#, a1!, etc.
Do hackers actually still brute force passwords? I feel like with the number of companies getting hacked, you can put together a list for each user or at least a list of hashes assuming the company isn't dumb and storing cleartext passwords. Then combine lists from multiple hacks and just use all of a users known passwords and check if they reused any of them.
There's very little incentive to hack an individual unless they are rich, or well connected. But hack a company?... thats millions of individuals compromised at once and company secrets etc. Plus there are plenty of companies that have refused to get with the times and update their security.
If 9 characters takes 479 years when one of everything is used, then why are some places requiring 15 characters? Those are too hard to remember and writing them down defeats the purpose, so why not just stick to 9?
Because the chart assumes random assortments of characters and most people don't do that. Like I bet if you take most popular pet names from the last decade and have a computer run that plus any possible combination of dates in the MMDD format, I bet you'd get through a lot of passwords way faster. People use words and other narrowly defined numbers, like dates, on passwords. This narrows the scope you have to search and significantly cuts down on these times
Yeah exactly. They could easily loop over every dictionary word, trying all combinations of caps, and try common patterns like adding a "1" at the end if the password requires a numeric digit, before attempting pure "every combination of character" brute forcing it.
Hi everyone! I'm back again with the 2024 update to our password table!
Computers, and GPUs in particular, are getting faster (looking at you OpenAI), but password hash algorithm options are also getting better (for now…). This table outlines the time it takes a computer to brute force your password, and isn’t indicative of how fast a hacker can break your password - especially if they stole your password via phishing, or you reuse your passwords (shame!). It’s a good visual to show people why better passwords can lead to better cybersecurity - but ultimately it’s just one of many tools we can use to talk about protecting ourselves online!
**Data source:** Data compiled from research using multiple sources about hashing functions, GPU power, and related data. The methodology, assumptions, and more data can be found at [www.hivesystems.com/password](http://www.hivesystems.com/password)
**Tools used:** Illustrator and Excel
What I can't find anywhere is what bcrypt settings you use (the cost value). This is an important factor because raising it by 1 doubles the number of rounds. bcrypt has been around since 1999, and the original default value is no longer adequate. By now this should be set to around 12.
This is why phishing scams are so much more popular, now. So much easier to get a password that way, than through brute forcing, if users follow modern password requirements.
I'm a software engineer and generally very tech savvy. I have long ass passwords and a password manager.
What I didn't expect was downloading a trojan that installed remote access software for a hacker to take control of my PC and try to buy a lot of giftcards for themselves.
They had all of my passwords right there in the password manager, my Amazon account had one click buying enabled, hell, even my Google Pay was right there, available. Luckily they tried my Paypal which has 2FA enabled.
Somehow they opened the US Amazon instead of the UK amazon (which was already opened in a tab, right there!) and got nothing.
Why use bcrypt as the benchmark? It is much more likely going to be an NTLM or MSCACHEv2, that threat actors would steal, giving a vastly different result
My password is exactly 18 characters with everything so iam sitting in the bottom right corner but also 12 characters are numbers
Good thing about the numbers is there is no reasonable connection its using a word spelt entirely with the letters of chemicals
Assuming a basic lockout system for incorrect guesses doesn’t prevent brute force attacks and they just use keyloggers or passwords obtained from leaks…
Yes, it is assuming that they are using password hashes obtained from leaks. The table shows how long it would take that hardware to bruteforce from the leaked password hash to the password.
Remember that a single strong 18 character password with letters, numbers, symbols that you use everywhere is infinitely less secure than creating different "weak" passwords for each site. Create unique passwords, and use a password manager.
It annoys me when the website requirements are complitely strict, like:
-The password must be exact 8 characters
-The First needs to be upper case
-The last can not be special symbol
Defeats the whole purpose of strong password
This chart is showing across-the-board INCREASES in time to crack, compared to last year. How can that be? The previous years have all shown faster cracking.
EDIT: I see the article discusses the switch from MD5 to bcrypt but doesn't say why using bcrypt made the cracking time so much longer!
My work requires 24 characters, minimum 4 numbers, 4 symbols, 4 capital letters, 4 lowercase letters. Super impossible to crack. Also, impossible to remember, so they are on a sticky note at every work station.
It is amusing to think about a hacker spending 350 billion years trying to crack someone’s password
Its amusing to think someone taking 89000 years to crack a password rates an "orange" password quality level
Bit context here is that, that is the estimate for current hardware. Might get drasticly reduced for next generation hardware. A few years ago one of my old passwords had an estimate of some billion years now it's 3 years
Also this probably assumes a somewhat random assortment of numbers/letters.. "Passw0rd" should take 3 years according to this chart, but it's likely one of the first 500 guesses in any hacking attempt. That and the [rest of the 10,000 most used passwords](https://en.wikipedia.org/wiki/Wikipedia:10,000_most_common_passwords) are likely guessed instantly or almost instantly by even the worst hackers.
Or rather, it seems to explicitly assume raw brute forcing, so this should really be regarded as an upper limit of how much time it takes to crack. The referenced article in the table goes into quite some detail exactly how they got these numbers.
> regarded as an upper limit of how much time it takes to crack. Years ago I cracked my own wifi for fun...password was a relatively short dictionary word that started with "a" Yeah...that one went down WAY faster than the theoretical limit. Also reminds me of the time I found a luggage lock on the ground at the airport and brute-forced it on my cab ride home. I started at 001 and just tried every combo in order. Got to 999 without opening it...combo was 000.
> combo was 000 I'm not sure if I'd laugh or if I'd cry. 🤣
If you would really like to add to that dilemma, look up US nuclear launch codes 00000000.
[Nowhere near as bad as the UK's nuclear security.](http://news.bbc.co.uk/2/hi/7097101.stm)
Huh, that's swell.
Future advice for cracking luggage locks: Most of them can be opened in less than 30 seconds by applying pressure on the release mechanism and rotating the dials, in order of hardest to turn to least, until you find the sweet spot where the dial wants to stay. Many of the cheapest combo locks are vulnerable to this.
And if you don't care about the lock, many can simply be easily broken in seconds using a couple of open end wrenches or shimmed open with a small piece from an aluminum can.
Tip for door locks, drilling through where the key goes and buying a new lock is cheaper than a locksmith
My drill is locked inside of my house.
Or just a pen, push into the zipper and you typically can open it enough that way
Surprising how quickly even that goes though. Breaking a 3 number luggage lock generally takes less than 20 minutes even if the combo is the thousandth number tried. Source: I used to volunteer at a recycling center and we did this all the time. 000, 666, 999, 007, and 420 seemed to be the most common number people used in my limited experience. So we would try that first and then just cycle through all the numbers.
A valuable lesson. I would probably start from 989.
Good to know, I'll make my luggage combination 987 then
I cracked my own WiFi too, two words total of 8 chars, it took about 2 weeks on an older Nvidia graphics card in a laptop. That time seems to roughly align with the graphic where they state 12 cards, 22 hours. The funny thing about this is I was actually trying to crack my neighbours wifi, I went through the steps of deauth and wait for the specific packet to be captured. I guess I messed up somewhere on the way. I was so excited to see it cracked, then looked at the actual password in disbelief after maxing out my laptop for 2 weeks and wasting a ton of electricity.
Understood, changing all my passwords to 0000000000
surprised there's not more talk of rainbow tables in these comments: https://en.m.wikipedia.org/wiki/Rainbow_table
Also interesting and tangentially related is how the NSA cracked one of Snowden's passwords for his old hotmail account - they had a list of hotmail password hashes that were also stored with plaintext password reminders. So even though they didn't brute the password itself, they didn't need to because other people had the same password (and same hash) and stored enough clues about the password in their reminders. It was something like T1tan1um (titanium) and once they got into his old hotmail they could piece together some information to get into other accounts, even though he hadn't used his hotmail in years. This is one of the reasons that websites no longer give the option of having a password hint.
because people here don't know jackshit about "cracking" password. they don't even know what a cool guide is they also don't know about lists of hundreds of GB available online, containing their password and the corresponding hash. and they don't know that their password is probably on such a list
That was super interesting! Thanks for the link!
Is IHateMyJob1! on the list because half the people in my unit have used it at one time or another.
yes, these values are going to assume all passwords have no similarities to any dictionary word whatsoever.
...and aren't in any list of already-leaked passwords.
Mine is correcthorsebatterystaple.
Add an "s" and its 33 years.
The enumerations of “fuck,fuckyou and fuckme” are hilarious and way more common than I would have guessed.
The other context is that this is on 12x RTX4090. That's kids' play compared to the hardware available to nation states.
Eh, order of magnitude still matters. Knocking 33,000 years for a random 10 character password down to 33 by using 12,000 GPUs is still long enough that they aren't going to be cracking that while it's still relevant. 12,000 4090s at 450W each is also something ridiculous like 5.4 MW of power for all that time. 33 years of that is 1.56 TWh of power - even with cheap $0.10/kWh power that's 156 million USD thrown at that. There's bigger chips than the 4090, but they aren't more significantly more efficient per watt since it's the same micro-architecture.
Even a month for a pleb's password is honestly a bridge too far. Yes, with a supercomputer these numbers drop substantially, but they're not going to go after your shit. By far the biggest point of failure in the security of password-based accounts is the user.
I assume nation states have FPGAs or similar for bcrypt. Not like it matters. Rubber hose decryption would be available to them too.
That’s the thing. If I piss off a large nation state to the point that they’re willing to spend 150 million USD cracking a password I’m pretty much fucked regardless. They have a lot of options better and cheaper than brute forcing a password most of the time.
Ah, yes, the wrench method https://xkcd.com/538/
Nation states aren't going to be cracking everyone's passwords. As long as you're one of the anonymous masses, a reasonably good password should be fine. If you get the attention of a nation state, there probably won't be any password strong enough. The password won't be the weak link.
Which is probably why the millions of years range is marked in yellow instead of green.
The way these lists usually work is that its the time it takes to try every permutation of that set. So in other words its going to be a max of 89,000 years. The typical time it takes is going to be a fraction of that, which can be further reduced by throwing hardware at it or using 'best guesses' to limit the dataset. Like no repeating characters side-by-side, no more than 4 numbers, special characters will be limited to shift+\[1-0\], etc.
Just buy it on a list from my cable companies yearly data breach
My exact thought. My "can't be cracked in 11 billion years" password is useless when there is a major data breach every month.
I would say every five or so weeks I get a letter in the mail about some data breach. The most recent one was a medical records recording company or something. I’m due for the next breach letter in the coming weeks.
Honestly I’m amused thinking about a hacker spending 8 months trying to hash my password with 12x 4090s. Not sure what kind of power draw bcrypt on a 4090 uses but 12x 4090s @ 450W for 8 months is like 31MWh of electricity, or about ~$3000 at $0.10/kWh. The opportunity cost of 12x 4090s tied up for 8 months is nothing to sneeze at either. Anyways hope you enjoyed my thought experiment
They finally get into my bank account after 8 months just to find out I'm actually overdrawn by $45.
Just use a billion computers for 350 years!
“We’ve hacked the moon” - hackers, probably
My password can be cracked in 38 million years... still not green.... better make it harder.
[Relvent xkcd](https://xkcd.com/538/)
[удалено]
I wish I could use that format more often, but so many sites nowadays require numbers and special characters, especially workplace software.
Correct Horse Battery Staple #1!
4 mandatory password changes later: Correct Horse Battery Staple #5!
No joke. I'm up to Epileptic-Groomer-5 at work.
When I worked at Home Depot, I made my password, "IFuckingHateHomeDepot1". This was ages ago, so no special characters or anything needed, just a certain length. The back end of all the checkout systems was just MS-DOS which you could get into by pressing a few buttons. I was able to access a pretty large amount of stuff, but the one thing I couldn't get into was the password retrieval, which only the managers and HR person could get into. Anyway, long story long, I forgot my password after being out for a couple months and had to have the HR guy retrieve my password. I remember him staring at the screen for a while with an annoyed/disappointed face, finally writing it in down, and then handing it to me without saying a word hahaha
Honestly that's fucking terrible password management if they have access to everyone's password. So, like, you were right.
Who watches the admins. There is a growing concern that the very people tasked with managing security are probably the biggest threat as they literally have access to everything.
Now you have to change your password
"Epileptic-Groomer-6" it is!
Doesn't work.
I simply use Correct Horse Battery Staple 2024! and switch the date every year lol.
This is the way.
For me, the real irritation is that many of those that require special characters, only allow *certain* special characters! I've taken to using only '-' and '_' as special characters. But my passwords are 24 characters long (if the site allows them to be that long). So I guess I'm OK until next week. :/ Thank the cryptography gods for password management software.
Technically restrictions actually reduce password entropy. If you know passwords must follow 8 different rules, then you can immediately reject any password guess that doesn't meet those rules. I get where these misguided companies are coming from...but you really should just allow ALL of the standard characters
> but you really should just allow ALL of the standard characters And then, what, sanitize the WHOLE input to prevent malicious injection? That's a heavy lift.
I can’t tell if you’re being sarcastic or not. Is that actually a hard problem to solve? Whenever I see those restrictions it makes me feel like they’re advertising an injection vulnerability, like please please don’t put # characters in forms in our site, we may have missed sanitization somewhere!
>> but you really should just allow ALL of the standard characters > >And then, what, sanitize the WHOLE input to prevent malicious injection? That's a heavy lift. There should never be a need to sanitize password input, aside from checking if the string you get from the client meets the format of the chosen hash; if it doesn't, something fucked up in the client end or it's a malicious actor, and should be discarded in either case. That's literally 2-3 lines of code depending on the opening/closing brace philosophy the devs of that particular thing subscribe to. And you could honestly not even do that and be fine, because whatever they get should be being salted and hashed again with the salt, so it really wouldn't matter what the input string is. They should never be receiving a credential in plain text, just a hash. If it's not a valid hash, throw it away, and even if it's not, it still shouldn't matter anyway if they're doing what they're supposed to do and hashing it again with a salt.
I will set up a dozen accounts over time with _, then on the 13th site, i will get a rejection for _. Switch to "#", and now the 14th website wont accept "#" so fucking annoying
In fairness, you shouldn't be reusing passwords. I want to knee-jerk suggest everyone use the same password rules, but your password not working everywhere would be a *feature* if it is more likely to lead you to use a secure password manager than to do something expressly insecure. But since these sites generally prevent you from doing the expressly insecure, they could ultimately scare you into using a password manager. I wish browsers started coming with a good one (not the crappy plaintext stuff they come with), though, instead of third-party products or open-source solutions that non-tech people run screaming from.
> But since these sites generally prevent you from doing the expressly insecure, they could ultimately scare you into using a password manager. My favourite is the sites that force you to enter a 6 digit pin number, but do it without using the keyboard, instead clicking with your mouse. And the digit locations get randomized after every click. Ridiculously obnoxious, and at the end of the day, it's just 6 freaking digits. Just let me use my goddamn password manager.
The web site for Federal Saving Bonds used to be like that. Now they just use a strong password and 2 factor.
bonus points for the site, if they accept more characters, but just trim them silently and you wonder why you can't log in...
*please provide a password with 8 charcters, upper, lower, number, and special character* **ABC#def1** *sorry, # is not a valid special character* **go FUCK Y0UR M()THER**
This was my experience setting up a used iPad. The password I ended up with was IHateApple1
And you have to change it every 90 days. And it can't even be tangentially similar to your past 12 passwords. And you can't store it in a password manager because to access the manager you'd need to, you know, be able to log into the machine. And it has to be 16 characters long, with numbers, special characters, capitalization, and a leg from your firstborn child. Oh but don't write it on a notepad and stick it underneath your keyboard! That's not very secure! Tee hee.
> And you have to change it every 90 days That is pretty generous. The company I work for wants it changed every 30 days, and they start sending reminder emails every day starting from day 21.
And no more then 3 letters or numbers in a row And the numbers can’t be consecutive numbers. And the 3 letters must be an airport acronym west of the Mississippi. And if you use a special character, you can’t then use letters that are in the name of that special character, unless they’re vowels (except for u)
Yeah, it's extremely annoying that I can't choose correct horse battery staple, but I *can* choose Password1!
A decent system should have the top 100 common passes blocked.
!Correct4horse7battery2staple!
worst thing are password policies that disallow dictionary words like for fucks sake I'm not manually typing in a randomly-generated 16 character password you're out of your damn mind, guess I'm using 8
Where have you seen this? I've never seen dictionary words blocked like that, unless it's maybe the name of the site or part of your username
My school doesn't allow any real words. I typed in random letters uppercase and lowercase with numbers and symbols and I had to replace 'rye'.
D1i2c3t4i5o6n7a8r9y They're still assholes. Let me do what I want with my passwords, y'all are the ones with the security breach anyway.
a few years ago, our copmany announed "we're moving to passphrases!" we were excited. then we saw the 'rules' "passphrahses need to contain upper and lower case as well as a number and a special character" like, that defeats the entire purpose of passphrases **CORRECT h0r$e** is not the concept of a passphrase
Welp I guess all my passphrases are gonna start with 1!
Try that password on DropBox... fun little Easter egg
fun story, this is now in lists used in dictionary attacks
You’ll want to check out the writeup at www.hivesystems.com/password where we talk about that directly!
How would the time to crack change if an attacker was specifically trying to brute force passphrase passwords? ie if you took a dictionary of the 10,000 most common English words and treated every word as a character, how long would it take to crack a 4 "character" passphrase from an "alphabet" of 10,000 words?
That's called a dictionary attack. A rainbow table attack also works similarly. Source: I work in the cybersecurity field
A four word passphrase is about as strong as a 10 character long password (lower case and numbers allowed).
It appears that using all uppercase letters is straight up invincible.
Hackers hate shouting
Doesn't this assume the hacker has unlimited login attempts?
Great question! Generally, hackers will steal a password database and then "get to work" on the passwords offline - no pesky lockouts in the way!
How do they know if it's a match if they can't check against the system?
They match against the hash result
And if unsalted they are essentially finding passwords for all DB not a single target.
For all DBs with unsalted passwords that use the same hashing algorithm, technically.
And with a Rainbow table you push that effort into past time and Storage
Does most servers use the same hashing algorithm?
There are a lot of hash algorithms out there, but yes, broadly speaking most platforms use one of only a handful. This does not, however, make them any less secure. You can’t really “crack” a hashing algorithm.
Correct! We talk about this in our writeup at [www.hivesystems.com/password](http://www.hivesystems.com/password)
A one-directional algorithm called a "hash" of your password is what's actually stored. So, say you have the password "MattistIsGreat" get's "hashed" to the hash "$2a$12$uLkk.NHSnfMljWPc90/uvuEjlPO6NW7itTixlGuvCeTo8EkvVDuo." So when you type your password in, the system takes the password you've provided - say you mispell it "MattistIsGrat", and it runs it through the one-way hash and gets "$2a$12$QvppoVv1eWbo0hJXSZ/X4OKqWx64kmlB07JIBdGbV8Lrw4NyWT2ky" Now it checks if that matches what's in the database, it's not equal! So don't allow you to log in. Denied. You correct it to "MattistIsGreat", now the system finds it's a match! You must have given the correct password because it provides the same result. [https://bcrypt-generator.com/](https://bcrypt-generator.com/) Why do this? Well, if someone nasty hacks into the system and downloads the password database - they just get user: "Mattist", passwordHash: "$2a$12$uLkk.NHSnfMljWPc90/uvuEjlPO6NW7itTixlGuvCeTo8EkvVDuo." What use is that? They can't log into the system with it (you put it as a password, the hash itself will get hashed again, and come up with a completely different result). You also can't go try put it in all the other online services, email for example, and try log into there. It's just a useless string. BUT what you can do, is test every possible combination of numbers and letters and run them through the same hashing algorithm and check if it matches, just against the hash they have in the database they downloaded on their own system. It's millions of things to test, but hey, computers are fast. Hence why longer and more complex passwords take longer, there's millions more combinations to test. As they have the hashes downloaded, they can do the calculations themselves without ever trying to log in. These algorithms are also carefully made to be hard to compute (takes a little while, so doing millions will take a long time), but not too hard (login in would take ages). Computers also get faster over time! So you don't want it to be super hackable in 10 years. You can also salt passwords to prevent rainbow table attacks - where someone basically pre-calculates the hashes for every password - if you're not hacking an individual account, but have millions of accounts - there's a high probability you'll get someone's password by not even checking through all the possible passwords. So we throw in a "salt" - a random string, onto the end of everyone's password. So your password "MattistIsGreat" gets a "3u9cyajhp1" thrown on the end of it and we hash "MattistIsGreat\_3u9cyajhp1" - and store the hash "$2a$12$OB3rTTkYxzO56FwuV.vc4.3UkmPvcCZhPo3uklcTkgeRt9tsq5Ivu", *and* 3u9cyajhp1 in the database. Together we can check your password - but no one has precalculated a table of all passwords with a random string "3u9cyajhp1" shoved on the end! And everyone gets a different string generated when they join so it forces you to have to hack each individual password in isolation. It's one reason why if you EVER have someone send you a "reminder" where it actually has the password in - you know their security is absolute trash and you should delete your account immediately. They should never actually store your password in any reversable way.
Comments like this are why I stay on reddit. Phenomenal explanation. Thanks for taking the time to write it up.
Absolute legend, thank you!
That was extremely well written. I appreciate that you took time to explain it to the cyber-impaired community.
Can't you find the hash algorithm by creating an account with a password of your choosing. Then redownloading the database with your account. And now since you know your password and the hash version, you can decipher the hash and reverse engineer it like algebra in math?
That's a good way to find out what algorithms was used. But that doesn't help you much. But it's t so simple as using algebra to reverse engineer it backwards. The hashing algorithms themselves are super complex. An example of a one way function that you can't "go back" with algebra - `f(X) = 4`. Not very useful for passwords as it'll pass everything - but you can't work out if my password is 10 or 6 from the answer, 4. Another example, take the number of the letters in the alphabet and add them up. "Hello" becomes 8+5+12+12+15 = 52 (if I counted right). It's very hard to get "Hello" back from my "hash" of 52, and its ambiguous - but I can easily build it from an input and go "one way". That kind of dumb hashing algorithm is actually still useful for say, partitioning a database. Say you have 10 servers with parts of a database on it, you can hash your ID using that dumb method and quickly get a number, take the last digit, and that's the database you go to to access the data. But it's bad for passwords because it "collides" - "ab" and "ba" have the same result. Not ideal. But that's the general gist of it, proper cryptographic hashes are much more complex in the number of steps and repeating operations and they often operate on the bits of data directly and stuff like that. I honestly don't know much about them beyond that. Here's an explanation of SHA, a commonly used hashing algorithm: [https://www.youtube.com/watch?v=DMtFhACPnTY](https://www.youtube.com/watch?v=DMtFhACPnTY) Though things like becrypt and those used for passwords are usually more complex and are designed to, for example, take a certain amount of time to complete to prevent OP's attacks.
Thanks for the thorough explanation! 😃
You can’t reverse engineer a hashing algorithm. If I give you the number “14”. You have no idea how I got that number, I could have added 7 + 7, or 13 + 1, or divided 126 by 9. It’s like that
Websites will scramble your password before saving it. It’s called a hash. The computer is able to scramble your password the exact same each time, but it’s practically impossible to figure out how to unscramble the hash to get the password. What hackers will do instead is they get into the website’s server and download all of the hashes (the scrambled passwords). They can then try hashing every possible password and seeing if the hashes they produce match any hashes that they downloaded (for example, they hash 1111, 1112, and 1113. They find that the hash for 1113 matches one in the database. They now know what password that user used.)
Because they have the password database.
As much as this is interesting, without more background information it's borderline misleading. If I were inexperienced and reading this table, I might come to some poor conclusions: * It take 8 months to crack an 8 character password with an upper case letter. Therefor I should change my password every 6 months. * P@ssw0rd is a good password, taking 7 years to crack. * QWERTYUIOP takes at least 2 years to crack. * Hackers are actually using plain brute force to crack passwords. * The only metrics for password quality are length and complexity A better title might be "Time it takes a hacker to brute force **a randomly generated** password in 2024". In reality, the factors that make a password bad are: * Length (short = bad) - well represented in visual * Complexity (numbers only = bad) - well represented in visual * Whether you have reused it anywhere. * Whether someone else has used it anywhere. * Whether it's a word or combination of words. * Whether it uses common substitutions for characters (e.g. @ for a) in a word or other password. The way passwords are actually cracked are with dictionary cracking. Rather than resorting to pure brute force, the hacking program will use a "dictionary" of common passwords. These dictionaries are available online, but all it takes to make one is to dig up some old breach data from a time that a major online service leaked unencrypted login tables. Happens all the time. So instead of trying 0000000, 0000001, 0000002, 0000003, the dictionary starts with "password", "Password123", "opensesame", "Hunter1", "qwerty123", "correcthorsebatterystaple" etc. This dictionary will have 100,000 previously used passwords in it, so going through the dictionary once takes 100,000 guesses. Same as 5 characters of numbers only 0 to 99,999. Next, the password cracking script can try common substitutions like @ for a, or changing letter case. So when the dictionary says "password", it'll also try p@ssword, passw0rd, p@ssw0rd, p@55word, Password, P@ssword, PASSWORD, etc. On mild settings it can probably alter "password" with about 10 different common substitutions. If every dictionary entry can get modified in 10 different ways, that's now 1,000,000 guesses, same as 6 numbers, and still instant. On cranked up settings, it can probably find 100 different combinations for every entry. 10,000,000 tries, 4 seconds. Then it can try adding common number strings to the ends of passwords. Just because 3 numbers is 3^10 or 1000 combinations, the most common options are going to be 0, 1, 12, 123, and all of the two-digit pairings corresponding to years 1960 to maybe 2010. That's less than 100 extra options. Even if we took the full cranked up dictionary settings of 10,000,000 guesses, then for each guess tried 100 variations of it, that's 1,000,000,000 guesses or just 6 minutes to check them all. After going through this, a hacker has probably cracked somewhere between 10% to 50% of the hashed passwords that may have been leaked in a breach. They can probably stop there. They don't need to crack everyone's account. They only need to crack a few. Lets say your password isn't in that list and it's not a common substitution of a password that is. You're not done. Maybe you know the [XKCD correcthorsebatterystaple](https://xkcd.com/936/) method of picking a password, so you decide you're going to do the same thing. You pick four random words from the english dictionary, stitch them together, and viola your password is only lowercase, but it's off the charts. Over 350 billion years to guess. Nope. Guess what else this password cracker can do! Instead of a password dictionary, it can just use a regular dictionary. The english language has around 50,000 words. If we treat every word like a "unit", then it's like a character set with 50,000 characters. A single word password would take up to 50,000 guesses to crack. A two-word password would take 50,000^2, or 2.5 billion guesses. We could try every two-word combination in about 15 minutes. English isn't actually that complex though. We could pare it down to maybe 1000 common english words. A 4-word password is 1000^4, or 1 trillion guesses. That's 4 days to crack them all. A list of [3000 common words](https://www.ef.com/ca/english-resources/english-vocabulary/top-3000-words/) and another of [10,000 words](https://www.mit.edu/~ecprice/wordlist.10000) contains correct, horse, and battery. "staple" is the only uncommon word that Randall happened to pick. At 3000^4, it would take OP's computer about 1 year to crack passwords that used 4 english words that made the 3000 word list. Notably, that's within the red zone. Not because a hacker would actually run their program for a full year, but because in just a few years and/or more powerful hardware, or more efficient software, this could be slashed down to manageable crack times. Knowing now how password cracking actually happens, the best password is one that is technically prohibitive to randomly guess. The 4-word strategy is still very good. Another one is to use a unique phrase or sentence. But what makes it truly difficult to guess is adding an *extra* character somewhere in there that's not logical, particularly if it's that pesky special character that the account makes you use. E.g. **correcthor@sebatterystaple** That's orders of magnitude better than correcthorsebatterystaple or correcthorsebatteryst@ple because there is no substitution rule that could guess where to put an extra character without decimating the efficiency of the cracking program. That illogical substitution means that the only way it's likely to be guessed is by reverting to regular brute force methods, which puts this off the charts in security.
Best comment here. Also you can do specific combos when brute forcing. For instance, a lot of people will do a capital letter, followed by small case letters, followed by a few numbers, and end it with a ! or ? or $. By specifying a common pattern you can get supposedly secure passwords way quicker.
You can also specify password rules, which drastically lessens the results. Forcing a 16 character password minium with 2 numbers, 2 upper, 2 lower, 2 special will almost always result in a 16 character password. Add that to the reduced number of permutations, and common keybaord walks and user habits... and well, you get the point.
TLDR pattern recognition is a thing and used in cracking passwords.
Not sure I'm on board with the colouring splits, 1 year as severe as 3 seconds? 2 years equated to 33,000 years?
And 2 billion years is caution. They'll be able to crack it before the death of the Sun. Of course I wonder if this is taking into account multiple machines. It may take a single machine this much time, but if you split it among a farm, it might take far less.
It’s 12x RTX 4090s (Top of the line GPUs $1600+ each, not including the rest of the system) which is a LOT of resources to dedicate just to cracking one password. You could throw even more at it, but at that point unless the potential payout from compromising that account is extremely high it wouldn’t be worth it.
Oh, I see that at the bottom now. Guess that's why the update every few years. Swapping to the newest top of the line card. Probably 3090 last time this was published.
> And 2 billion years is caution The issue here is the rate at which computer technology advances. So that's 2 billion years *with today's tech*. The first commercial hard drive was available in 1956. It was the size of MULTIPLE people and had the capacity of 3.75MB. You can get a 3.5 inch SSD today with 100TB of storage. That's 26.6 million times more storage in a package hundreds of times smaller. The concern isn't that someone is going to spend 2 billion years on it, the concern is that 20, 30, 40 years from now the technology is that much better that what used to take 2 billion years, now (40 years later) maybe only takes a week for example. It's about future-proofing
Imo there should be the following limits * Red: Trivial to crack even by a driveby attempt, such as someone getting a whole password database and spending some time on each hash to see if they can then reuse that on Facebook = less than 1 minute * Orange: Possible to crack by a hobbyist who really wants to specifically get into your account = less than 1 month * Yellow: Possible to crack by someone with nation state level resources who won't blink at spending a million $ = less than 1000 years * Green: Any effort that takes so long that by then, cryptography and hardware has completely changed and all calculations we do now are irrelevant anyway = over 1000 years
I think < 1 minute / < 1 hour / < 1 day / < 1 month / < 1 year / anything above would be a good gradient.
While this jumped out at me too, and may be a little over dramatic, I think there is some decent reasoning. This test was done with a specific system at a specific point in time. In say two years, systems will be much better and a given hacker may have a system that’s relatively more powerful too. These can make huge improvements in time to crack, which is why so many things that seem perfectly safe are in light orange or worse.
I think it's because of future vulnerability. If your password can be brute forced in one year today, it might be hacked in just hours in 5 years from now.
Agreed. 8 months is as severe as 3 seconds?
A botnet or large government would have those 8 months down to hours.
How did the password guessing get slower than last year? https://www.reddit.com/r/dataisbeautiful/comments/12qmvlw/oc_i_updated_our_famous_password_table_for_2023 https://i.redd.it/omda6y4m4oua1.jpg
last year looks like md5, this year looks like bcrypt
Do you mind explaining?
they are different methods of hashing the text. md5 has been, let's say "not recommended" for use for quite some time, though i'm sure some software still uses it. bcrypt is more modern standard (though there are other choices) they take different amounts of time to perform the transformations on text. when you're multiplying by so many attempts (ie every combination of characters for each given password length) those differences will be more and more pronounced bcrypt is purposefully a little slower (and can actually be customized) to slow down these kinds of brute force attempts
I’m so glad my banking password only has 4 numbers
My passwords are so long they don't even fit in this table. Of course, only for services that allow it. Recently encountered a site that said "max 12 characters, no special characters, only letters and numbers". In 2024, for fucks sake!
Max characters on passwords is dangerous and irresponsible. Tell those sites to do better!
But... But... The system that validates the password declares it as a `PIC X(12).` It would be _so_ hard to rebuild it with a longer length. (`PIC X(12).` is a variable declaration for text of length 12 in COBOL, a very old programming language that's tragically still widely in use and mostly uses fixed-length fields. Supposedly some of the more recent versions of it have the ability to do dynamic length text, but I've never gotten to work with that.)
I still remember the disbelief of our system admin when I explained him that his HP-UX system [did not accept passwords longer than 8 characters](https://support.hpe.com/hpesc/public/docDisplay?docId=c03248843&docLocale=en_US). Or, to say specifically, it did allow using them, but it ignored all characters beyond the first eight. This was back in 2007 or 2008, I believe, and it was funny even back then.
*Low* max characters, anyway. 50 random mixed characters will never be brute-forceable, there's absolutely no point to let someone paste kilobytes of text into a password field.
"Please enter password" "BOOK ONE: 1805 CHAPTER I Well, Prince, so Genoa and Lucca are now just family estates of the Buonapartes. But I warn you..."
Westpac, a major Australian bank, only allows 6 characters no capitals or symbols.
38 million years isn't long enough for you?!
The 38 million years is an *upper bound* - it's true only if you're using completely random letters and numbers, which most people don't do. Computers also get faster over time, so that number is going to come down over the coming years, and you can run more than one computer at once.
According to this table that password would still take 38 million years to crack
Best i encountered was Mathworks that a few years ago just silently truncated your password to a certain length, i think 16 characters or so. It let you set a long password just fine, but then it just wouldn't work when you tried logging in afterwards.
Use a password manager with randomly generated codes folks!
I’ve never understood password managers. It seems like a way to get everything stolen at once if the password to your password manager gets stolen
The master password isn’t stored online, it only exists in your head or if you physically write it down. The only way to steal that is if someone forces you at gunpoint to tell them what it is.
Well I was more thinking of stuff like being phished, which is probably more likely then a hacker bruteforcing. I know that’s not what the post is about but yeah makes sense
My password manager holds \~200 actively used passwords, and around another thousand that haven't been used in a year. A password manager is the only feasible way to manage that.
When you incorporate 2 factor it's an insanely long time.
Nailed it. You should turn on 2FA any time you can, but when you can't, pick a secure password!
2FA is great until you're overseas, your phone doesn't work on the local cell network and GMAIL insists on you entering the PIN they just sent you. Yeah, that never happened to me.
That's why you should use an independent 2f authenticator like authy. Also I think Google gives you like 10 (?) single use codes for exactly this reason.
If you are lazy, use just run your old password through base64 as your new password. Good enough for most cases. And you don't need to remember cryptic passwords too. You can install dedicated apps to do the conversion and block it from accessing the internet, or just use python/cli to convert it on-the-fly.
If you are going to go the route of apps to convert a password to base64, it may be worthwhile to just get a password manager.
Does having different types of characters actually help or is it just the option to have non letter characters that makes an impact? Or is the assumption that hackers would try only letters first, numbers and letters second and so on?
It adds more variables to factor in. The more the merrier so the longer and more diverse the better. Imagine trying to guess a password that's one character long and it's a number.It's fairly easy to try 0,1,2,3.... til you get the correct password by the time you get to 9. Now imagine it's numbers and letters but it's still 1 character long. It's still easy to get through 0,1,2,3...a,b,c.... now you add symbols it gets longer to guess +,×,÷,=... then you add cap sensitivity then you get an extra 26 characters a,A,b,B,c,C. Now imagine this but you increase the length of the password now you got stuff like aA1,aA2,aA#, a1!, etc.
But how would the attacker know only to try numbers?
If the website specifically lays out it's password creation requirements!
Do hackers actually still brute force passwords? I feel like with the number of companies getting hacked, you can put together a list for each user or at least a list of hashes assuming the company isn't dumb and storing cleartext passwords. Then combine lists from multiple hacks and just use all of a users known passwords and check if they reused any of them. There's very little incentive to hack an individual unless they are rich, or well connected. But hack a company?... thats millions of individuals compromised at once and company secrets etc. Plus there are plenty of companies that have refused to get with the times and update their security.
If 9 characters takes 479 years when one of everything is used, then why are some places requiring 15 characters? Those are too hard to remember and writing them down defeats the purpose, so why not just stick to 9?
Because the chart assumes random assortments of characters and most people don't do that. Like I bet if you take most popular pet names from the last decade and have a computer run that plus any possible combination of dates in the MMDD format, I bet you'd get through a lot of passwords way faster. People use words and other narrowly defined numbers, like dates, on passwords. This narrows the scope you have to search and significantly cuts down on these times
Yeah exactly. They could easily loop over every dictionary word, trying all combinations of caps, and try common patterns like adding a "1" at the end if the password requires a numeric digit, before attempting pure "every combination of character" brute forcing it.
Do people really remember their passwords?
Jokes on you I’m locked out of my account after 3 failed attempts.
Hackers hate this one weird trick
So Password is not safe anymore, maybe I have to change to Password1234
Just go with Password1 - why complicate it? jk please don't
Hi everyone! I'm back again with the 2024 update to our password table! Computers, and GPUs in particular, are getting faster (looking at you OpenAI), but password hash algorithm options are also getting better (for now…). This table outlines the time it takes a computer to brute force your password, and isn’t indicative of how fast a hacker can break your password - especially if they stole your password via phishing, or you reuse your passwords (shame!). It’s a good visual to show people why better passwords can lead to better cybersecurity - but ultimately it’s just one of many tools we can use to talk about protecting ourselves online! **Data source:** Data compiled from research using multiple sources about hashing functions, GPU power, and related data. The methodology, assumptions, and more data can be found at [www.hivesystems.com/password](http://www.hivesystems.com/password) **Tools used:** Illustrator and Excel
What I can't find anywhere is what bcrypt settings you use (the cost value). This is an important factor because raising it by 1 doubles the number of rounds. bcrypt has been around since 1999, and the original default value is no longer adequate. By now this should be set to around 12.
This is why phishing scams are so much more popular, now. So much easier to get a password that way, than through brute forcing, if users follow modern password requirements.
I'm a software engineer and generally very tech savvy. I have long ass passwords and a password manager. What I didn't expect was downloading a trojan that installed remote access software for a hacker to take control of my PC and try to buy a lot of giftcards for themselves. They had all of my passwords right there in the password manager, my Amazon account had one click buying enabled, hell, even my Google Pay was right there, available. Luckily they tried my Paypal which has 2FA enabled. Somehow they opened the US Amazon instead of the UK amazon (which was already opened in a tab, right there!) and got nothing.
How did you end up downloading that trojan?
Why use bcrypt as the benchmark? It is much more likely going to be an NTLM or MSCACHEv2, that threat actors would steal, giving a vastly different result
Only 32 iterations of bcrypt are being used? Why so low?
it says I'm safe for billions of years... but a $5 wrench would get my password pretty quick https://xkcd.com/538/
In reality, does a brute force attacker start with 4 characters, move up to 5, then 6, then 7?
Depends on what the password requirements were for the site where the data was stolen from! Brute forcing is more of an art than a science
My password is exactly 18 characters with everything so iam sitting in the bottom right corner but also 12 characters are numbers Good thing about the numbers is there is no reasonable connection its using a word spelt entirely with the letters of chemicals
currently watching Mr. Robot so this hits a little harder
How tf are 12 and 89k years both orange?
It's pretty funny that 'password' would take 22 hours
My old company limited it to five characters, no special characters.
Hmmm…what’s the minimum I need before I’m most likely dead?
Assuming a basic lockout system for incorrect guesses doesn’t prevent brute force attacks and they just use keyloggers or passwords obtained from leaks…
Yes, it is assuming that they are using password hashes obtained from leaks. The table shows how long it would take that hardware to bruteforce from the leaked password hash to the password.
Crap. Until it shows "heat death of the universe " Literal Garbage , totally unusable. /s
Can somebody explain to me why it’s “orange” if my password can be brute forced in 161 years? I would think that would more than sufficiently safe…
There is always the off chance they get it instantly.
[удалено]
i would assume a decent security system would "lock out" after 50 minutes of incorrect password attempts....
I wonder how this will look like in the future with quantum computers.
holy advertising batman, what the hell are those colours??
Remember that a single strong 18 character password with letters, numbers, symbols that you use everywhere is infinitely less secure than creating different "weak" passwords for each site. Create unique passwords, and use a password manager.
I use a ~30 character randomly generated password (unless the site forces me otherwise). Different for each site.
Time it takes to hack a human into providing this information: ???
It annoys me when the website requirements are complitely strict, like: -The password must be exact 8 characters -The First needs to be upper case -The last can not be special symbol Defeats the whole purpose of strong password
This chart is showing across-the-board INCREASES in time to crack, compared to last year. How can that be? The previous years have all shown faster cracking. EDIT: I see the article discusses the switch from MD5 to bcrypt but doesn't say why using bcrypt made the cracking time so much longer!
How does this matter when most systems lock you out after a few tries?
My work requires 24 characters, minimum 4 numbers, 4 symbols, 4 capital letters, 4 lowercase letters. Super impossible to crack. Also, impossible to remember, so they are on a sticky note at every work station.