How Quickly Can Your Password be Cracked?

Nope. The number and type of characters make a big difference.

How big? Adding a symbol eliminates the possibility of a straight dictionary attack (using, literally, words from a dictionary. Adding a symbol, especially an unusual one, makes it much harder to crack even using rainbow tables (collections of alphanumeric combinations, only some of which include symbols).

How big a difference to length and character make?

How long would it take to crack my password: (Includes letters and numbers, no upper- or lower-case and no symbols)

Six Characters: 2.25 Billion Possible Combinations

1. Cracking online using web app hitting a target site with one thousand guesses per second: 3.7 weeks.
2. Cracking offline using high-powered servers or desktops (one hundred billion guesses/second): 0.0224 seconds
3. Cracking offline, using massively parallel multiprocessing clusters or grid (one hundred trillion guesses per second: 0.0000224 seconds

Ten Characters: 3.76 Quadrillion Possible Combinations

1. Cracking online using web app hitting a target site with one thousand guesses per second: 3.7 weeks.
2. Cracking offline using high-powered servers or desktops (one hundred billion guesses/second): 10.45 hours
3. Cracking offline, using massively parallel multiprocessing clusters or grid (one hundred trillion guesses per second: 37.61 seconds.
4. Add a symbol, make the crack several orders of magnitude more difficult:

Six Characters: 7.6 trillion Possible Combinations

1. Cracking online using web app hitting a target site with one thousand guesses per second: 2.4 centuries.
2. Cracking offline using high-powered servers or desktops (one hundred billion guesses/second): 1.26 minutes
3. Cracking offline, using massively parallel multiprocessing clusters or grid (one hundred trillion guesses per second: 0.0756 seconds

Ten Characters: Possible Combinations: 171.3 Xextillion (171,269,557,687,901,638,419; 1.71 x 1020)

1. Cracking online using web app hitting a target site with one thousand guesses per second: 54.46 million centuries.
2. Cracking offline using high-powered servers or desktops (one hundred billion guesses/second) 54.46 years
3. Cracking offline, using massively parallel multiprocessing clusters or grid (one hundred trillion guesses per second: 2.83 weeks.

Take Steve’s advice: go for ten characters, then add a symbol.

By Kevin Fogarty, ITworld    Jun 10, 2012 12:13 pm