Your Password Isn’t as Random as You Think

Watch on YouTubeWhy Password Symbols Barely Make You SaferThe same mechanism as a video, built around one real ten-line rule file and what its ninth line does to the word sunshine.

Type a password into one of those how-long-would-it-take-to-crack-this sites and a number comes back. Usually a comfortable one. Thousands of years, sometimes billions, with a bar underneath it going green.

Put the same eight characters into three different sites and the three answers can be ten orders of magnitude apart. That is the first clue that some part of this is being assumed rather than measured.

I went looking for what the number is actually a measurement of. It is a real calculation and the arithmetic in it is correct. The input it runs on is wrong, in one specific place, and the wrong place is not the one people argue about.

The number is a division

Every one of those estimates does the same two steps.

Step one is counting. Look at which kinds of character are in the password, work out how big that alphabet is, and raise it to the length. All lowercase gives you an alphabet of 26. Lowercase and uppercase and digits and the punctuation you can reach on a standard keyboard gives you 95. Eight characters drawn from 95 possibilities is 95 multiplied by itself eight times, which is 6,634,204,312,890,625 possible passwords.

Step two is dividing. Pick a number of guesses per second and divide the count by it.

alphabet ^ length  =  how many passwords
                   /  guesses per second
                   =  the number on the bar

You will often see that written in bits instead. Entropy, in this context, is just the count expressed as a power of two: a space of 6.6 quadrillion is about 2^52.6, so the password is described as having 52.6 bits. It is the same quantity in a more compact costume, and it exists because adding one character to a password multiplies the space, and people find adding bits easier to reason about than multiplying quadrillions. Nothing in this article changes if you prefer one form over the other.

Some meters also halve the space before dividing, on the grounds that an attacker sweeping through in some order finds you halfway on average. That is a sensible refinement. Hold on to how big it is, because it is a factor of two, and it is about to be sitting next to a factor of forty six million.

The operand nobody can see is the second one. Here is the same eight-character space against three guessing rates, all three of which are real rates that some tool somewhere assumes.

6,634,204,312,890,625 passwords

  at 10,000 a second      21,023 years
  at 1 billion a second       77 days
  at 164 billion a second     11 hours

Same password. Same count. The answer moves from twenty one thousand years to one working day, purely on an assumption about the attacker that the site did not show you and probably did not let you set.

So the honest version of the question is what rate to use. That is the argument I expected to end up in.

Nobody is guessing at the login box

The rate only means anything once you know where the guessing happens, and it is not where it looks like it happens.

Against the login box on a website, guessing is hopeless. Five wrong tries and you are locked out, and every attempt costs a round trip across the internet. At that rate the arithmetic above gives you numbers with a lot of zeroes on them and the green bar is telling the truth.

But the site never had your password. When you sign up, a competent site runs what you typed through a hash function, which is a one-way scramble: it turns any input into a fixed-length string of hex, the same input always produces the same output, and there is no way to run it backwards. That lets the site check you at login by scrambling what you just typed and comparing, without ever storing the password itself. It also means the thing sitting in the database is the scramble, not the secret.

That table is what leaks. The breaches you read about are copies of it getting out.

The left column is struck out before the border closes, which is the point of the beat. The thing that leaks is the right column, and the password you typed is never inside it.

Good sites also salt, which means mixing a unique random value into each password before hashing so that two people with the same password do not end up with the same stored string. Salting kills a couple of shortcuts an attacker would otherwise have, and it does not change a single figure in this article, because none of what follows depends on precomputing anything.

$un$h1n3
   -> 3f80c697d47d7dc11cde9b1e13298962

That is the real MD5 of those eight characters, and you can check it on any Mac by running md5 -s '$un$h1n3' in a terminal. Once an attacker has a file full of those, the login box is irrelevant. He takes the hashes home, puts them on his own machine, and guesses there, where nothing counts his attempts and nothing rate-limits him. The only ceiling left is how fast his hardware can compute the same scramble.

Bottom left still reads five of five, which was the login box's entire budget. The counter on the right is the same guessing done at home, where nothing is keeping score.

What one card does in a second

That question has a published answer. Chick3nman maintains benchmark runs of hashcat, the password recovery tool everybody in this field actually uses, and it costs nothing to download. Every figure in this article comes off one of those runs: hashcat v6.2.6, one stock RTX 4090, nothing overclocked.

one stock RTX 4090, hashcat v6.2.6

MD5              164,100,000,000 a second
bcrypt, cost 5           184,000 a second
                 -----------------------
ratio                    891,848x

Those two lines are the same card doing the same job, and they are 891,848 times apart. The difference is entirely in which scramble the site chose.

One stock card running one scramble, counted up rather than stated. That figure is the divisor under every number after this point, and it is the operand the meter never showed you.

MD5 was designed to be fast, because most things you want a hash for benefit from speed. bcrypt was designed to be slow on purpose. It has a cost setting, and turning the cost up makes every single hash more expensive to compute, which costs the site a millisecond it will never notice and costs the attacker a factor of a million he cannot avoid. That is the whole idea. If a site chose the slow one, you are in far better shape than this article implies, and you have no way to find out which one your bank picked.

I am using the MD5 rate from here on, and every number below is that rate on that one card. It is the pessimistic end, it is the one that applies to the sites that got this wrong, and the entire argument is going to be stated as a ratio anyway, so the card cancels out.

Eleven hours for everything

Now run the meter's own division with a rate that describes an actual attacker.

Every eight-character password you can type on a standard keyboard, all 6,634,204,312,890,625 of them, random junk included, takes that card about eleven hours to work through. Not eleven hours to crack yours. Eleven hours to exhaust the entire space, after which he has definitely got yours, along with everybody else's.

The strings run off the bottom edge on purpose, because six and a half quadrillion of them do not fit on a screen. Eleven hours is the price of reaching all of them, not of reaching yours.

That is the ceiling. It is the largest number the meter's method can possibly justify for eight characters, and it is a working day.

And he is not going to need anything close to it.

Fourteen million passwords, already written down

That space never gets searched. The attack starts from a file.

A wordlist is exactly what it sounds like: a plain text file with one candidate password per line, ordered so the likely ones come first. The famous one came out of a single breach in 2009 and has been passed around ever since, and it holds about fourteen million entries. Copies of it differ slightly, which is why you will see the count quoted a few different ways and why I am saying “about”. Without a list like this an attacker is back to guessing character by character. With it, he is replaying choices that real people actually made.

Read the top of it and the ordering tells you what it is.

line 4    password
line 26   sunshine
line 27   chocolate

Fourteen million lines, every one of them a password somebody sat down and picked, which means somewhere in that file is the word you would swear nobody else would think of. That is the entire premise, and there is nothing clever in it. It is a file.

Three readable lines out of about fourteen million, with the rest left as texture because that is what it is. What matters is where they sit, which is near the top.

Fourteen million guesses at 164 billion a second is not a meaningful amount of time. The list on its own is over before the fan spins up.

A rulebook is a file of things people do to words

Your password is probably not on that list exactly. It is a word from that list with something done to it, and he knows that, so he bends them.

A mangling rule is one line of a second file telling the program what to do to a word before it tries it. Put a 1 on the end. Capitalise the first letter. Swap every e for a 3. The tool reads the wordlist and the rulebook together and, for every word, tries every rule, which means the cost of covering the exact thing you did to your password is one more line in a text file and one more sweep through the list. That is what a rulebook buys, and it is why the modification you made in 2014 to get past a validation message is not a secret.

Hashcat ships with a folder of these. One of them, rules/top10_2025.rule, is ten lines long, and I pulled it out of the repository rather than quoting it from memory:

# rules/top10_2025.rule

:
$1
$1 $2
$1 $2 $3
c
u
$!
d
so0 si1 se3 ss$ sa@
$2 $0 $2 $5

The syntax is compact and takes about a minute to learn. : means leave the word alone, which is there so the unmodified wordlist gets tried as part of the same pass. $1 appends the character 1, so $1 $2 $3 appends 123. c capitalises, u uppercases the lot. $! puts an exclamation mark on the end. d duplicates the word.

The ten empty gutters are drawn before anything fills them, because ten is a claim about the file. Line nine arrives last and stays unlit, which is the only thing this shot is setting up.

Then there is the ninth line, and it is worth taking on its own.

Line nine

so0 means substitute every o with a 0. Line nine chains five of those:

so0   every o becomes 0
si1   every i becomes 1
se3   every e becomes 3
ss$   every s becomes $
sa@   every a becomes @

Run that one line against line 26 of the wordlist. sunshine has no o and no a, so two of the five substitutions arrive and do nothing at all, which is a fair picture of how these files work: the rule is general and the word is specific. The three that do fire give you $un$h1n3.

Eight characters, two dollar signs, two digits standing in for letters. Exactly the shape a sign-up form nags you into, produced by one line of a ten-line file.

Watch o to 0 and a to @ go grey as the rule runs. Sunshine has neither letter, so two of the five do nothing at all, and the three that fire produce the string at the top of the frame.

I ran the same line over the other two entries above, because a demonstration that only works on the example it was chosen for is not worth much:

sunshine   ->  $un$h1n3
chocolate  ->  ch0c0l@t3
password   ->  p@$$w0rd

Line 4 of the leaked list, through line 9 of the rule file, is p@$$w0rd. Not a variant of it. That string.

One thing I checked while writing this, because nearly every article on the subject names a different file. The rulebook usually cited is best64.rule, which no longer exists in hashcat. The one that does is best66.rule, and I downloaded it to see whether it produces the same result. It does not. Its entire substitution section is three lines, so0, si1 and se3, with no dollar sign and no at sign anywhere in it, so best66 cannot make $un$h1n3 at all. The ten-line file can. If you are going to put a number on this you have to name the file you got it from, which is why I am naming it.

What that actually cost him

Fourteen million words times ten rules.

14,344,391 words x 10 rules
   =    143,443,910 guesses
   /  164,100,000,000 a second
   =    0.00087 seconds

Under a thousandth of a second, on the same card, against the same scramble that took eleven hours to exhaust the whole eight-character space.

The eleven hours from earlier stays on screen, dimmed, directly above the number that replaced it. Same card, same scramble, two different attacks.

whole 8-char space   6,634,204,312,890,625
this attack                    143,443,910
                     ---------------------
                            46,249,467 : 1

The meter counted 6.6 quadrillion. The attacker paid 143 million. The gap between what the estimate is measuring and what the attack costs is a factor of forty six million, and I want to put that next to the factor of two we set aside earlier for the halving convention. Meters get criticised for being off by small integers. Whatever this is, it is not that.

The counting step priced the shape of the password. The contents were supplied by a person, and the contents are the half he already had.

And ten rules is a toy. Hashcat also ships dive.rule, which is 98,676 lines long and contains 98,670 actual rules, the other six being blank lines and comments. I counted both because the difference is the sort of thing that quietly turns into a wrong figure in somebody's blog post.

14,344,391 x 98,670 rules
   =  1,415,361,059,970 guesses
   =        8.6 seconds

Every clever substitution you have ever thought of is somewhere in that file, and running all of them against every leaked password anyone has ever chosen costs nine seconds.

Two sixteen-character passwords the arithmetic cannot tell apart

Go back to line 8 of the ten-line file. d, one character, duplicate the word.

Feed it sunshine and it hands back sunshinesunshine. Sixteen characters, all lowercase, and now run that through the meter's method. Alphabet of 26, length of 16, which is 43,608,742,899,428,874,059,776 possible passwords, a twenty three digit number. At 164 billion a second that is 8,421 years.

The ruler counts to sixteen and it is right to. The rule that got there is one character long and it is line eight of ten.

Here is the awkward part.

oncmsrpdnqzytpmq      26^16   8,421 years
sunshinesunshine      26^16   8,421 years

Those two strings score identically. Same alphabet, same length, same count, same estimate, and any meter working the way described at the top of this article has to give them the same answer, because the only things it looked at were which kinds of character are present and how many of them there are.

This is the meter's own arithmetic, run honestly on sixteen random lowercase letters, with the eight-character figure from earlier kept above it for scale. Nothing on this frame is wrong.

The first one costs 8,421 years. The second one costs one guess. It is line 26 of a file everybody has, through line 8 of a file everybody has, and there is no third thing involved.

The ruler and its sixteen go grey and the price stays lit. That swap is the whole difference between the two strings in the block above.

That is the shape-and-contents split from two sections ago, run again on a password with no symbols in it and nothing leetspeak about it. The shape here is sixteen lowercase, and the shape is genuinely worth 8,421 years. The contents are one word from line 26 written out twice, and they are worth nothing. Sixteen characters typed is not sixteen characters of anything the attacker had to work for.

Four words, done honestly

Somewhere around here the standard advice arrives, because nobody memorises sixteen random letters. Use four ordinary words instead.

The rigorous version of that is Diceware, a published list of 7,776 short words where you pick each one with physical dice, five rolls per word, so the randomness is genuinely outside your head. Four words picked that way is 7,776 to the fourth power, which is 3,656,158,440,062,976 possibilities, and on that card, six hours.

Six hours, against eleven for the ugly eight-character random string. The memorable, universally recommended thing loses to the thing it tells you to stop using.

The bracket runs the opposite way from the advice, with the memorable option on the cheaper side. Note the word random lit on the top row, because that condition is doing all the work.

That comparison is real, and it is also the point at which I have to be careful, because the same mechanism that ate sunshinesunshine is sitting underneath it. Six hours is the figure for four words chosen by dice. Four words you picked because they sounded good together are a different quantity entirely, and the honest answer for those is that nobody can put a number on them, because the attacker's wordlist is a record of what people pick when they are picking.

That is the third time the same split has done the damage. The estimate prices the shape, a person supplies the contents, and the contents are the half sitting on his disk already.

Why the sign-up form stopped asking

The boxes you tick on a sign-up form came out of guidance published by NIST, the American standards body, and a lot of the world copied that guidance without reading past the summary. NIST has since gone back on two of its own requirements: the forced capital, number and symbol, and the mandatory change every ninety days. Both dropped.

The forced symbol is worth exactly one line of the attacker's rulebook. Line nine, out of ten. Forcing it on everybody guarantees him a population of passwords with a predictable modification applied, which makes his ten-line file better than it was.

NIST asks for length instead. It also, notably, asks sites to check new passwords against lists of known-breached ones, which is the defensive use of the same fourteen-million-line file.

Two strikes rather than four, because two requirements were dropped and one of them covered three boxes on the form. Line nine drifts in beside the struck symbol box on its way out.

So, back to the meter

The number the bar shows you is a real division. Count the possible passwords of that shape, divide by a guessing speed, print the answer. The only thing it gets wrong is the assumption underneath the first step, which is that you are a random number generator.

You are not, and the attacker's entire toolchain is built out of that fact. A word list is a record of what humans actually choose. A rulebook is a record of what humans actually do to what they choose. He is not searching a space of characters. He is replaying a space of habits, and habits are much, much smaller.

So the useful question when a form asks for a symbol is not whether the symbol makes the password stronger. It is whether the symbol is something you would have thought of. If it is, somebody wrote it down as a line in a file years ago. And it is being tried against every hash in every stolen database, once, cheaply, forever.

Give it the letters instead.

One gap I cannot close on my own. Every time in this article comes from one published benchmark on one stock RTX 4090 running hashcat v6.2.6, and the whole argument is stated in ratios precisely because that single card will be embarrassing in a few years. If you have a GPU in the machine you are reading this on, run hashcat -b -m 0 and tell me the MD5 figure it reports and which card it is. I would like to see what the eleven hours actually looks like across a spread of real hardware rather than one gist.

🎉 Enjoyed this article? Your support means the world to me!

🎬 Subscribe on YouTube for video versions of these posts: https://www.youtube.com/@swift-pal

💼 Let's connect on LinkedIn for more professional insights: https://www.linkedin.com/in/karan-pal

☕ If this saved you some time, you can buy me a coffee: https://coff.ee/karanpaledx