TwiddleLab / Math / Counting and Patterns

Project: How Many Passwords?

Lesson 11 of 11 · 8 min · Free, no account needed

What you will learn

• A password rule is a chain of choices: choices per spot, multiplied once per spot. 8 spots from 62 characters is 62 to the power 8.
• Time to crack = passwords ÷ guesses per second. At a billion a second, 13 digits last hours and 14 lowercase letters last 2,000 years.
• Length beats fancy characters: each extra spot multiplies the count, a bigger alphabet only raises the base.
• Random words count as big symbols: 4 words from 7,776 is 7,776 to the power 4. A word with tricks is not random.

Start the lesson

How the lesson goes

1. Which password takes a cracker longer to guess?

   Tap the one you would trust more. Then we count instead of guessing.

2. A PIN is digits only. Find the shortest PIN that lasts at least 1 hour.

   The cracker tries a billion PINs a second. Slide the number of digits.

   13 digits give 10 to the power 13 PINs. Divided by a billion a second that is 10,000 seconds, about 2.8 hours. 12 digits give only 1,000 seconds.

3. Length 8. Make the cracker need more than a day.

   Switch kinds of characters on. Each one adds choices to every one of the 8 spots.

   A day is 86,400 seconds, so you need 86,400 billion passwords. 52 to the power 8 is only 53 trillion; 58 to the power 8 is 128 trillion, and 62 to the power 8 is 218 trillion.

4. Only lowercase letters, length 3. How many passwords are there?

   Each wheel has 26 letters and every combination is allowed, so the counting principle gives 26 × 26 × 26 = 17,576.

5. 12 lowercase letters. How long to try them all?

   Drag the lever to your estimate. Anything within 10 times the true time counts.

   26 to the power 12 is 9.5 × 10^16. Divided by 10^9 a second that is 9.5 × 10^7 seconds, and a year is 3.16 × 10^7 seconds, so about 3 years.

6. Longer, or more kinds of characters?

   Press Try A and Try B to time each rule. Then tap the stronger one and Check.

   26 to the power 12 is 9.5 × 10^16, while 94 to the power 8 is 6.1 × 10^15. Each extra spot multiplies the count; a bigger alphabet only raises the base.

7. Put four rules on the ladder: weakest at the bottom.

   Drag each rule onto a rung. Count in your head first: choices per spot, times itself once per spot.

   10^4 = 10,000; 26^6 is about 309 million; 62^8 is about 218 trillion; 7,776^4 is about 3,656 trillion. A word list of 7,776 works like an alphabet of 7,776 symbols.

8. Back to the hook: race the two passwords.

   Smart crackers don't try every character. They try common words with tricks first. Start both crackers.

9. Design your own password rule. It must hold for at least 100 years.

   Pick characters and a length, or switch to random words and pick how many.

   100 years is about 3.2 billion seconds, so a rule needs more than 3.2 × 10^18 passwords at a billion guesses a second.

10. A short Python program checks your rule.

    The loop multiplies the choices once per spot. Press Run.

11. Game: hacker's night.

    A cracker has 8 hours at a billion guesses a second. For each rule, tap Falls tonight or Survives.

12. Count the choices, multiply, divide by the guess rate.

    Here is your rule on a card. Tap Make an example to see a password it allows.

Previous lesson: Clock Arithmetic: Remainders · Part of the course: Counting and Patterns

Lessons are interactive and need JavaScript. Turn it on to play them.