4 ms·
The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z
by thedufer 13y ago
The algorithm they're using first replaces all "top passwords" in yours with a single lowercase character ('a'). Then, it counts the number of lowercase (/[a-z]/), uppercase (/[A-Z]/), numbers (/[0-9]/) and special (/[^a-zA-Z0-9]/) characters. It assigns lowercase and uppercase characters 26 possibilities, numbers 10, and special characters 32, and multiplies to get the number of possible passwords. This is divided by a "standard computing power" to get the number of hours it would take to crack.
This is about as rough as an approximation as you can get. For example, if your password contains dictionary words that aren't in their top passwords, it drastically overestimates the the difficulty of cracking it.
Type `"".hackability` in the console to see the code.
- khafra 13y agoThanks for the overview. It'd be nice if they could make a password strength checker that got the exact strength instead of an estimate, that would be cool (because actually building a hypercomputer is impressive).
- jerf 13y agoThere isn't really an "exact strength"; a password cracker exhaustively trying all permutations of letters and numbers will never find your password with !, a password cracker exhaustively trying all combinations of letters and numbers will take a very long to find "electroencephalograph" whereas a dictionary attack will find it very quickly if that's in the dictionary, etc. It depends on the order the cracker is trying the passwords in.
- thedufer 13y ago"exact strength" depends on the algorithm being used. If you're just checking dictionary words, some passwords would be really weak; if you're exhaustively checking every combination of characters, the same passwords would be pretty strong, and a different set would be very weak.
- mentat 13y agoWonder how many filtering proxies got triggered by the NSFW words in that list. Would be funny if Intel.com got temporarily black listed.