How long should a password be?

[Brye]

There's a lot of confusion concerning password security, especially among your average person. So I thought it would be good to open up a discussion in order to educate people, including ourselves. How important is it to create a long password? Is length even important or is compexity the most important?

 

[Gandalf_The_Grey]

Some (old) info, but no clear answer from Troy Hunt of "Have I Been Pwned":

Passwords Evolved: Authentication Guidance for the Modern Era

In the beginning, things were simple: you had two strings (a username and a password) and if someone knew both of them, they could log in. Easy. But the ecosystem in which they were used was simple too, for example in MIT's Time-Sharing Computer [https://www.wired.com/2012/01/

www.troyhunt.com

How Long is Long Enough? Minimum Password Lengths by the World's Top Sites

I've been giving a bunch of thought to passwords lately. Here we have this absolute cornerstone of security - a paradigm that every single person with an online account understands - yet we see fundamentally different approaches to how services handle them. Some have strict complexity rules...

www.troyhunt.com

Have I Been Pwned: Check if your email address has been exposed in a data breach

Have I Been Pwned allows you to check whether your email address has been exposed in a data breach.

haveibeenpwned.com

 

[Vincent Valentine]

If u are using password manager just go as long as it allow

 

[Local Host]

The minimum recommended password lenght nowadays is between 8 and 12 characters.

 

[TairikuOkami]

Note, that most strength meters uses CPU as a baseline, but today, GPU is used to calculate algorithms, so 1 PC with 4 GPUs is more powerful.

Password Checker & Secure Random Password Generator | Kaspersky

Check your password security and see if it can resist hackers. Use our random password generator to instantly create strong, unique passwords and stay protected.

password.kaspersky.com

If u are using password manager just go as long as it allow

If it were only possible, I usually have to test, what is the allowed maximum. Paypal is a total disappointment, with its 20 characters limit.

 

[blackice]

Note, that most strength meters uses CPU as a baseline, but today, GPU is used to calculate algorithms, so 1 PC with 4 GPUs is more powerful.

Password Checker & Secure Random Password Generator | Kaspersky

Check your password security and see if it can resist hackers. Use our random password generator to instantly create strong, unique passwords and stay protected.

password.kaspersky.com

If it were only possible, I usually have to test, what is the allowed maximum. Paypal is a total disappointment, with its 20 characters limit.

Most of the time credentials are stolen or common passwords checked. I haven’t seen a lot of reports of brute force used in non-targeted hacks. If/when the average joe starts having their account brute forced god help us all.

 

[TairikuOkami]

I haven’t seen a lot of reports of brute force used in non-targeted hacks.

Indeed, 30% will simply give away their password, when asked nicely. Add phishing on top and hacking a password is just for targeted attacks.

 

[ForgottenSeer 823865]

It is not about length but complexity. But most of all about being able to remember it by without writing it anywhere.

Then: Discuss - [Umbra's Tips] How to create a secured single password for ALL your sites.

 

[Divine_Barakah]

Given the fact that my passwords are stored an a password manager, I always use the longest passwords (24 characters and even 30 characters long). Some websites have limited support of passwords (e.g. 16 characters maximum), so it depends.

 

[Thales]

I think length is more important than complexity. Why is that?
The cracker will never know if you use symbols and numbers or a simple but long password with full of just lowercase characters or just numbers.
If the dictionary attack or backdoor doesn't work they won't try brute force. It would take years. Without knowing your solution they need to use every possible combination of lowercase and uppercase letters, numbers and symbols.

But I am open to other opinions.

 

[bribon77]

Well, if I think the size in this case does matter.
I have used decryptors.
And I managed to decipher up to three letters, then it becomes difficult, but I am not a decryption specialist, there are tools that hackers use that can facilitate it if it is a short password.

 

[ng4ever]

58 characters.

 

[Fuzzy_Bunny]

 

[simmerskool]

It is not about length but complexity. But most of all about being able to remember it by without writing it anywhere.

Then: Discuss - [Umbra's Tips] How to create a secured single password for ALL your sites.

but Mr Gibson says the most important factor is password length!

GRC's | Password Haystacks: How Well Hidden is Your Needle?

Password Haystacks: How Well Hidden is Your Needle?

www.grc.com

of course he discusses complexity too.

 

[South Park]

If using a password manager, I would recommend generating the longest random password the site will allow. The default setting of 20 or 24 chars in KeePass should be sufficient for most uses. (Some banks, surprisingly, limit the max length to as little as 10 or 12 chars or forbid special characters!)

 

[Divine_Barakah]

I would recommend generating the longest random password the site will allow.

That's exactly what I do. I lose nothing because I do not have to memorise them; it's the job of 1Password here lol

 

[Local Host]

but Mr Gibson says the most important factor is password length!

GRC's | Password Haystacks: How Well Hidden is Your Needle?

Password Haystacks: How Well Hidden is Your Needle?

www.grc.com

of course he discusses complexity too.

Both length and complexity add to the password bitrate, complexity more than length (you should have uppercase, lowercase, numbers and symbols regardless of your password length).

A simple password with 32 characters is more insecure than a complex password with 16 characters.

 

[Gangelo]

I don't believe that stolen credentials are being generated by brute force attacks. You must be a high value target for the hacker to spend all the time and effort to brute force your password. If the website database has been breached, complexity & length do not matter. It should only be as long and complex to not be guessed by an outsider.

I do the middle solution, fixed 12 characters long with uppercase, lowercase, numbers and special characters generated by my password manager.

 

[struppigel]

Is length even important or is compexity the most important?

I would like to pick this subquestion.

Given that the complexity is how many characters you are allowed to use for the password.
Given that a more secure password is one that would need more time to bruteforce.

The number of possible words you would need to test with bruteforcing is then our metric of saying how secure the password is.

You calculate the number of possible passwords using: NumberOfPasswords = NumberOfCharacters^PasswordLength
E.g., if you have a password of length 3 and digits only (aka 10 characters): 10^3 = 1000
On the other hand a password of length 10 and 3 characters: 3^10 = 59049

So length is more important than complexity.

-----------------------------------------------------------------------

However, this theoretical approach does not take into account dictionary attacks which are commonly used.
In practical terms:
password length and complexity only need to be enough so that bruteforcing doesn't help anymore. A password of length 24 is practically as good as 12 because both can't be bruteforced in a reasonable time frame
beyond that you definitely need to avoid dictionary attacks by:

• Not reusing passwords that you use somewhere else (one dataleak of plain text passwords and your passwords will potentially be added to word lists).
• Not using passwords that are likely used by other people.
• Avoiding actual words with meaning in general. That includes combinations of words with added digits or words in 1337 speak. Attackers know that these are typical modifications and may generate these variations automatically.

 

[TairikuOkami]

RpZ@qxrdyaUXVuz6RQrn!@LP5FdvWogC!Hsx*$*HVWh%qtQJBz%Z!8unYCbUD*M^S&tx%gaMDLnyC^^%Nvd6trz9ovZrUW$ARDGU*9YgukBpi4hpd^Zcg!SXLKZTMyRj

I pick 128 characters long password (as seen above) and Microsoft is like: