I'm sorry, this is incorrect. Facebook does not store additional hashes. If the provided string does not match, they also try the following 3 variations; 1)

I'm sorry, this is incorrect. Facebook does not store additional hashes. If the provided string does not match, they also try the following 3 variations; 1) String with case inverted -- effectively undo capslock 2) String with first character lowercased, if it was uppercase 3) String with last character removed So your example, a single guess of all 'A's would not match. You can try it yourself if you like! EDIT: So it's actually 3 extra tries, not 4 extra tries.