Packetizer

Secure Password Generator

Generating a strong, secure password is critical to protect your bank accounts or other online accounts, and for use with software like AES Crypt.

The question many people ask is, "What is a strong password?" You will find that some web sites will demand the use of special characters, including !, %, $, and so forth. Such requirements actually do not lend significantly to the strength of a password, as you'll see below. The secret to a good password is randomness and length.

Much of the details found on the page below might not be of interest to most people, so you can skip it. Perhaps what most people might want is one of these two applications:

It is always a good idea to use different password for different web sites and different applications. A tool like Single Pass makes it possible to create very cryptic passwords using a single master password. Note that for extra security, it is possible to use a random password for both the "Single Pass Password" and the "Service Name". Without knowing both values, it would be impossible to generate the "Service Password".

Creating a Secure Password

By default, Packetizer's Secure Password Generator generates passwords using only letters, numbers, and digits. Further, we recommend use of those characters to make it easier for humans to use. After all, that is what passwords are for: humans. It is fair to ask if such passwords are strong enough for various applications. The answer is "yes", as the length and randomness of the password determines its strength. We will explain.

Note: the password generator software referenced above will generate passwords using special characters if requested; we just do not do that by default and do not recommend it.

The reason we do not recommend use of special characters is that special characters like '&' add very little to the strength of the password, but make it more difficult for humans to use. What is important is the number of bits of strength. The above password uses 62 different possible values, including numbers, uppercase letters, and lowercase letters. This means each character provides about 5.95 bits of strength (log2(62)). Twelve such characters will yield 71.45 bits of strength. That means there are about 2^71.45 (or 3.23x10^21) possible values a hacker must inspect in order to crack the password.

If you prefer a slightly stronger password, you could generate one from a pool of 93 different characters that use special characters (e.g., $, !, %) in addition to letters and numbers. Using 93 different characters provides about 6.54 bits of strength per character (log2(93)). So, 12 characters provides 78.47 bits of strength. That means there are about 2^78.47 (or 4.18 x 10^23) possible values.

What is the benefit? With special characters, there is a total strength of 78.47 bits, versus 71.45 bits with the friendlier password. That is just a mere 7 bits. If you wish to have the extra strength, use a 14-character password. A 14-character password comprised of only letters and numberswould provide 83.35 bits of strength. With 16 characters comprised of letters and numbers, we get a total of 95.27 bits of strenth, providing for 2^95.27 or (4.77 x 10^28) possible values.

Another important point is that we should never worry that a password is easier for humans. Computers do not care how easy a password is for humans. A computer will simply work through the combinations of characters, no matter what those characters might be. The important thing, as we have said before, it the length and randomness of the password. By now, it should be clear that when we refer to the length, we refer to the bit length of the password.

For applications like AES Crypt, password strength is more important than for the typical web site. Such software will produce files that might be attacked off-line over a period of years with many computers in parallel. AES Crypt uses a 256-bit encryption key, but uses a password to secure that key. Ideally, this means that passwords should also be at least 256 bits long. Just for good measure, we recommend using passwords that provide 384 bits of protection. To achieve that, one would need at least 43 characters in the password, yielding 43*log2(62) ~= 256 bits of strength. If you feel the password strength should be stronger, then by all means create longer one using the above tools (or concatenating two shorter random passwords together).

Cracking Passwords

As of 2011, there are commercial products that claim to be able to generate 2,800,000,000 passwords per second (source: Wikipedia). So, with 12-character passwords made up of letters and numbers, it would take a single computer 3.23x10^21 passwords / 2.8x10^9 passwords/second / 3.154x10^7 seconds/year = 36,513 years to crack.

In 2012, there were claims that one commercial product could crack passwords at a rate of 350 billion per second. At that rate, a 12-character made up of letters and numbers could be cracked in 3.23x10^21 passwords / 3.5x10^11 passwords/second / 3.154x10^7 seconds/year = 292.3 years to crack.

Some purpose-built systems can crack passwords at a much higher rate, but even if processing at 10x or 100x the rate, it will take a long time to crack. Further, an attacker should not have a chance to attack a remote server for such a long time. Thus, we're confident that a 12-character password is quite acceptable for any web site.

For cases where an attacker might have prolonged access to a password hash to do an off-line attack, we recommend using 14 or more characters. By comparison, a 16 character password would take 4.3 billion years to creack (2^(log2(62)*16) passwords / 3.5x10^11 passwords/second / 3.154x10^7 seconds/year).

Using an even longer password for such things as AES Crypt is recommended, as noted in the previous section, since hackers might have prolonged access to your data and might use any number of cracking machines in parallel.

Why Random Passwords

We stated several times that password strength is a function of the length and randomness of the passwords. However, much of the article focused on length. Do not forget the importance of randomness.

Some password generators on the Internet create long, but very "simple" passwords. For example, they might generate passwords that are a concatenation of English words and number like "Spoon2Gobbler". We do not recommend using those. Such passwords make it very easy for attackers to perform a "dictionary" attack on your password. Even "words" that are not real words, but phonetically appealing, make for weaker passwords. It is always best to passwords comprised of random bits of data that nobody can possibly guess. Make them truly random and cracking them becomes extremely difficult.

To give you an example, let's assume you used the above "Spoon2Gobbler" password. Let's assume that the attacker had a dictionary of 100,000 words. Of course, these words would be in that dictionary. Let's assume the attacker knew the password might be any of the following forms: word + digits + word, word + digits, digits + word. Further, the attacker could assume that the words either either all lowercase or had a leading uppercase character. Assume also that the number of digits might be 1 or 2. To attack the first form (word + digits + word), the attacker would try (100,000 * 2) * 100 * (100,000 * 2) combinations. That is an impressive 4 trillion combinations, but would take that high-end password cracking machine just 23.81 minutes to crack. Hackers would likely use an even smaller dictionary, too, because most people would only select from a dictionary of commonly-used words that are more likely far less than 5,000 words. If we can assume a 5,000 word dictionary, the same attack would take about 4 seconds.

Do you want to force a person to work for a few million years or a few seconds to get into your your confidential information or bank accounts? Length and randomness are really essential.

External Links

Several sites can check the strength of your password: