How long will it take to crack your password?

[Jimbo Gomez]

http://www.lockdown.co.uk/?pg=combi&s=articles

edit: the copy/paste screwed up the legibility, check the link to get it properly.
Password Recovery Speeds
How long will your password stand up
This document shows the approximate amount of time required for a computer or a cluster of computers to guess various passwords. The figures shown are approximate and are the maximum time required to guess each password using a simple brute force "key-search" attack, it may (and probably will) be possible to guess correctly without trying all the combinations shown using other methods of attack or by having a "lucky guess".
See the bottom of the page for details about the classes of attack.

10 CharactersJust numbers. As you can see choosing a password from such a small range of characters is a bad idea.

Numerals 0123456789
Password Class of Attack
Length Combinations Class A Class B Class C Class D Class E Class F
2 100 Instant Instant Instant Instant Instant Instant
3 1000 Instant Instant Instant Instant Instant Instant
4 10,000 Instant Instant Instant Instant Instant Instant
5 100,000 10 Secs Instant Instant Instant Instant Instant
6 1 Million 1½ Mins 10 Seconds Instant Instant Instant Instant
7 10 Million 17 Mins 1½ Mins 1½ Mins Instant Instant Instant
8 100 Million 2¾ Hours 17 Mins 1½ Mins 10 Seconds Instant Instant
9 1000 Million 28 Hours 2¾ Hours 17 Mins 1½ Mins 10 Seconds Instant
26 CharactersThe full alphabet, either upper or lower case (not both in this case).

Upper Case Alpha ABCDEFGHIJKLMNOPQRSTUVWXYZ
Lower Case Alpha abcdefghijklmnopqrstuvwxyz
Password Class of Attack
Length Combinations Class A Class B Class C Class D Class E Class F
2 676 Instant Instant Instant Instant Instant Instant
3 17,576 < 2 Secs Instant Instant Instant Instant Instant
4 456,976 46 Secs 5 Secs Instant Instant Instant Instant
5 11.8 Million 20 Mins 2 Mins 12 Secs Instant Instant Instant
6 308.9 Million 8½ Hours 51½ Mins 5 Mins 30 Secs 3 Secs Instant
7 8 Billion 9 Days 22 Hours 2¼ Hours 13 Mins 1¼ Mins 8 Secs
8 200 Billion 242 Days 24 Days 2½ Days 348 Mins 35 Mins 3½ Mins
9 5.4 Trillion 17 Years 21 Months 63 Days 6¼ Days 15 Hours 1½ Hours
10 141 Trillion 447 Years 45 Years 4½ Years 163 Days 16 Days 39¼ Hours
12 95 Quadrillion 302,603 Years 30,260 Years 3,026 Years 302 Years 30 Years 3 Years
15 1.6 Sextillion 53 Trillion years 532 Million years 53 Million years 5 Million years 531,855 Years 53,185 Years
20 19.9 Octillion 63 Quadrillion years 6.3 Quadrillion years 631 Trillion years 63.1 Trillion years 6.3 Trillion years 631 Billion years
52 CharactersThis time we're trying the full alphabet but using a mixture of upper and lower case letters, that effectively doubles the number of combinations when compared with just using a single case.

Mixed Alpha AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz
Password Class of Attack
Length Combinations Class A Class B Class C Class D Class E Class F
2 2,704 Instant Instant Instant Instant Instant Instant
3 140,608 14 Secs < 2 Secs Instant Instant Instant Instant
4 7.3 Million 12½ Mins 1¼ Mins 8 Secs Instant Instant Instant
5 380 Million 10½ Hours 1 Hour 6 Minutes 38 Secs 4 Secs Instant
6 19 Billion 23 Days 2¼ Days 5½ Hours 33 Mins 3¼ Mins 19 Secs
7 1 Trillion 3¼ Years 119 Days 12 Days 28½ Hours 3 Hours 17 Mins
8 53 Trillion 169½ Years 17 Years 1½ Years 62 Days 6 Days 15 Hours
9 2.7 Quadrillion 8,815 Years 881 Years 88 Years 9 Years 322 Days 32 Days
62 CharactersMixed upper and lower case alphabetic characters plus numbers.

Mixed Alpha and Numerals 0123456789AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz
Password Class of Attack
Length Combinations Class A Class B Class C Class D Class E Class F
2 3,844 Instant Instant Instant Instant Instant Instant
3 238,328 23 Secs < 3 Secs Instant Instant Instant Instant
4 15 Million 24½ Mins 2½ Mins 15 Secs < 2 Secs Instant Instant
5 916 Million 1 Day 2½ Hours 15¼ Mins 1½ Mins 9 Secs Instant
6 57 Billion 66 Days 6½ Days 16 Hours 1½ Hours 9½ Mins 56 Secs
7 3.5 Trillion 11 Years 1 Year 41 Days 4 Days 10 Hours 58 Mins
8 218 Trillion 692 Years 69¼ Years 7 Years 253 Days 25¼ Days 60½ Hours
96 CharactersMixed upper and lower case alphabet plus numbers and common symbols.

Mixed Alpha, Numerals & Symbols 0123456789AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz <SP>!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
Password Class of Attack
Length Combinations Class A Class B Class C Class D Class E Class F
2 9,216 Instant Instant Instant Instant Instant Instant
3 884,736 88½ Secs 9 Secs Instant Instant Instant Instant
4 85 Million 2¼ Hours 14 Mins 1½ Mins 8½ Secs Instant Instant
5 8 Billion 9½ Days 22½ Hours 2¼ Hours 13½ Mins 1¼ Mins 8 Secs
6 782 Billion 2½ Years 90 Days 9 Days 22 Hours 2 Hours 13 Mins
7 75 Trillion 238 Years 24 Years 2½ Years 87 Days 8½ Days 20 Hours
8 7.2 Quadrillion 22,875 Years 2,287 Years 229 Years 23 Years 2¼ Years 83½ Days
ExamplesThese are just a couple of examples to show the resilience of certain types of password, using the information in the tables above you will be able to make your own examples.

Sample Passwords Class of Attack
Pwd Combinations Class A Class B Class C Class D Class E Class F
darren 308.9 Million 8½ Hours 51½ Mins 5 Mins 30 Secs 3 Secs Instant
Land3rz 3.5 Trillion 11 Years 1 Year 41 Days 4 Days 10 Hours 58 Mins
B33r&Mug 7.2 Quadrillion 22,875 Years 2,287 Years 229 Years 23 Years 2¼ Years 83½ Days
Classes of AttackThese are just some example speeds, I'd be interested to hear from people with more information about the speed taken to crack various types of passwords with various hardware.

A. 10,000 Passwords/sec
Typical for recovery of Microsoft Office passwords on a Pentium 100

B. 100,000 Passwords/sec
Typical for recovery of Windows Password Cache (.PWL Files) passwords on a Pentium 100

C. 1,000,000 Passwords/sec
Typical for recovery of ZIP or ARJ passwords on a Pentium 100

D. 10,000,000 Passwords/sec

Fast PC, Dual Processor PC.

E. 100,000,000 Passwords/sec

Workstation, or multiple PC's working together.

F. 1,000,000,000 Passwords/sec
Typical for medium to large scale distributed computing, Supercomputers.


Distributed.net's Project Bovine RC5-64 possibly the fastest computer on earth has recently reached a speed of 76.1 Billion passwords per second!

Friday 7th April 2006 10:05

[PsychoStick]

the article doesn't say what type and bit encryption is used. :(

[Macrobius]

NOTE: the OP article is 2006 as cut/paste, 2009 at the link. Pentium 100's are a bit rare these days, but networks of 100,000 machines dedicated to screwing you over by criminal means, with better horsepower, are now seen in the wild. Things are much much worse than in 2006....

The recommendation keeps changing. These days, brute force cracking is likely even for passwords that met corporate best practice guidelines a mere 5 years ago (if you can be sniffed in plaintext, whatever you do about 'encryption' is hopeless anyway). Encryption methods no longer matter -- they can all be brute-forced if the DB is stolen from a hacked machine [happens to everyone these days...] and has the hashed 'encrypted' passwords in it. Just assume you've got 24 ... 36 hours max. Time estimates for the crack are hours to days, depending on your password strength. Criminal networks exist with sufficient parallel computing power to make this credible and even probable. This development is why banks are being pushed to do 'two factor authentication' -- which means more than just one password -- by law in the US, on pain of being on the losing side of a class action suit for negligence.

These days, the latest is that you should use *decorated* passwords just to beef up the length.

To help you remember them, decorate your passwords with a mix of punctuation, numbers, upper and lower case letters, and symbols. Use the decoration as a prefix and suffix for a simple, easy to remember one -- that is different for each site.

This makes it easier to use long passwords, because, you can use the same decoration all the time -- producing a long, hard to crack password -- without using the *same* password everywhere.

Example:

1. Pick an easy to remember phrase (likely, one of the weak passwords you routinely use for every single site and can remember because you've used it at hundreds of sites, hundreds of times a day, for decades -- shame on you, Mr Normal Person):

opensesame

2. Pick a decoration you can remember. Suppose you like giving people {{{hugs}}}.

prefix: 1488{{{
suffix: }}}fourteenW

3. Now combine them:

1488{{{opensesame}}}fourteenW

Even though that has one of the most obvious and widely used passwords as a vulnerable, juicy core, none the less it is now rather strong. It is likely stronger than b5;%19*BQc76

4. If you are even *tempted* to use the same core word for every site, at least add something that is different and connected with the site, e.g. PH for 'The Phora':

1488{{{opensesamePH}}}fourteenW

Now you can remember the decoration (because you use it all the time...), your passwords are long and hard to crack, they fit the necessary criteria, and they are not the same for every site.

What about those banks and liability for this? From the ever reliable Ian Griggs: https://financialcryptography.com/mt/archives/001338.html

[Dapper Old Gent]

Most people use the "Mixed Alpha and Numerals", this is why most websites now expect you to use at least six characters.

Even though it says it would take 66 days for a six digit password, I know for certain that to crack a password hash for a forum takes closer to 100 days using a standard computer. Using the NASA or Amazon supercomputer you can do it in a matter of hours - I know because I've tried it.

[Crowley]

Doesn't software react adversely to repeated attempts at password entry? Seems like software could restrict password attempts to something sane like 100 a week and defeat this hack. What am I missing?

[Macrobius]

Doesn't software react adversely to repeated attempts at password entry? Seems like software could restrict password attempts to something sane like 100 a week and defeat this hack. What am I missing?

Most of the problematic cracks these days involve theft of the entire database of some large company (often a gaming network, sometimes with a bunch of credit card numbers). About 30% of those passwords, once cracked, will *also* work on the email in the same database.

Because the thieves have a copy of the database, they can set up and try it as many times as they wish, without getting 'locked out' for too many tries. The objective is either credit card numbers, or legitimate accounts [emails and passwords].

A list of legitimate accounts with passwords is valuable because the list can be sold to spammers, who might use control of the email accounts to create automated registrations -- perhaps at a forum like this one.

They can also scan the email accounts by looking at each message, and looking for a credit card number. If the person whose email is hacked ever sent an email with the credit card number in it, it would be easy to harvest, and would be connected to a known email.

A Russian based ring, engaged in credit card fraud or spamming, would not restrict themselves to 'a single computer' -- so the time it takes standard hardware to do the crack would not be relevant.

[PsychoStick]

[QUOTE=Macrobius]
A list of legitimate accounts with passwords is valuable because the list can be sold to spammers, who might use control of the email accounts to create automated registrations -- perhaps at a forum like this one.

They can also scan the email accounts by looking at each message, and looking for a credit card number. If the person whose email is hacked ever sent an email with the credit card number in it, it would be easy to harvest, and would be connected to a known email.
QUOTE]

This is why Macrobius also recommended modifing each password a little for each site you use. If you use the same password for your bank and for paypal, along with your e-mail, and they already have access to your e-mail with that password the possibilities are endless. Also, don't keep password lists saved in your e-mail account in the form of an e-mail to yourself (I don't know why people do this, but it's common)

[Dapper Old Gent]

Doesn't software react adversely to repeated attempts at password entry? Seems like software could restrict password attempts to something sane like 100 a week and defeat this hack. What am I missing?Back in my hacking days (usually legitimate) I would steal the whole password database or hash table, then I could hack, dictionary attack or brute force it at my leisure. A better way of doing things is to intercept the interaction between the server and the users, stealing the public and private keys and then decoding the password that was sent. You can do this with hardware as well, but it requires you to physically be there and so your chances of getting caught go up significantly.

[Ixtab]

The password I use is the same except for one part of the password, which is easy to remember because I use something on the website itself to remind me of that part of the password. The rest of the password is random and utilises symbols, numbers, and upper case and lower case letters. Thus I don't have to memorise a completely different password for every account I have on the internet.

[Macrobius]

The password I use is the same except for one part of the password, which is easy to remember because I use something on the website itself to remind me of that part of the password. The rest of the password is random and utilises symbols, numbers, and upper case and lower case letters. Thus I don't have to memorise a completely different password for every account I have on the internet.

Now the problem is you need to increase the length of that password to about 12 characters or better 20.

[Ixtab]

Now the problem is you need to increase the length of that password to about 12 characters or better 20.
The password length varies but it is always over 15 characters.