However, if the attackers would employ dictionary words separated by spaces, even then the second password would have ~2^70 guesses (roughly the amount of words in the English language to the power of 4) which is a lot more than the 2^44 guesses you'd get by brute-forcing.

but what if I combine the "word space word" pattern with "leetspeak"? And then if I combined it with "makes a complete sentence with punctuation and intitial caps"? Even if you have a library of common password techniques, you must combine them, and also partially. It's kind of.. bullshit, honestly, to assume godlike knowledge of the password pattern chosen that reduces entropy by half.

I think this password strength checker has a bit too simplistic assumptions ... yes, I assume that there are dictionaries with leet-speak replacements out there (or programs which automatically apply them). (Google does not find this particular word, though.)

The problem is, even when there are individual password crackers for such problems, as an attacker, you don't know which method you have to use. The xkcd calculation is based on the fact that the first password is built exactly like that; if there is just one difference, the password cracker will fail. So unless you know which method to use, it's practically impossible to crack it. And then comes the fact that you usually combine multiple methods…

but what if ... - well, if we compare different methodologies, we have to assume that one is superior over all others, so that nearly everybody is using it, and the attacker knows, what to attack - so he will for example 40.000 words ^ 4, because everybody suggested to choose 4 words. If everybody uses this, using something else is better, but you can't suggest to everybody, to use something which nobody else uses. It doesn't scale. So a scalable suggestion has to work, even if the attacker assumes, you're using it.

A different question is, where and how the password is used, for how long, for what, how many of them do you need, and what is the environment. Do you control a intercontinental atomic missile, or some secrets from your wife/your father? How often do you need to input the password. In many situations, it is no problem to leave the password on a sticky note on your monitor, and in many situations, it is a big problem. A one-size-fit-all-password-policy might not be appropriate, but teaching all the subtle differences can be a bigger problem, than an oversized security policy.

@Arda Xi, 2^70 guesses relies on the dictionary word user coming up with secrets from the full range of English dictionary words. How many people will come up with "rhabdomyomata tintinnabulary isodica berimbaus" and the like? "correct horse battery staple" isn't only dictionary words, it's easily thought of and easily spelled dictionary words, and that likely reduces the search space a lot.

@Jeff, this answer is flawed. You rely upon rumpkin for password entropy estimation, but rumpkin's estimates are apparently bogus. Look at the xkcd comic again: it visually depicts the justification for its entropy estimate (that's what the little boxes are doing). xkcd's entropy estimates look about right to me, and your entropy estimates look wrong (overly optimistic). I totally disagree with your conclusion, and I don't see where you get it from.

I expect it will be braindead brute force all the way 72^11=2.6956E20; 26^28=4.16E39; Still over double the difficulty.

There already exist password crackers that try 'leet' substitutions. Diceware uses a list of 7776 short words and easy to remember strings. I'd be interested to see the timing results of a cracker that had the same dictionary.

@Jeff, I assume you've seen this - How reliable is a password strength checker? My answer there shows a basic comparison of entropy breakdown, short complex password vs long simple password. Also see this answer which discusses the entropy of dictionary phrases. The password strength checker you used does not account for dictionary words, or entropy of selecting English language words as opposed to bruteforcing random characters.

Even using John the Ripper 5 years ago, I would always have 1337-speak conversions built in as it is very quick and easy to do.

@TessellatingHeckler Even if you take that into account, there's a big difference between 2^44 and 2^70. For a dictionary as small as 2048 words, it's going to take 2^44 tries to get a four-word password, similar to what a brute-force would be.

Reducing the entropy in half would be subtracting one bit of entropy. If you remove half the bits of entropy, you're actually reducing the entropy by its square-root.

The rumkin.com checker is dangerously misleading. It's much less sophisticated than the simple common sense in the XKCD comic, so it shouldn't be used to "confirm" anything. Try it on "passwordpasswordpasswordpassword" which allegedly has 128 bits of entropy and is "overkill" security.

I'm a fan of pass-phrases; but long complex passwords are only hard to remember because I have to use so many different passwords. I suspect the same would be true if I had to use 6 word pass phrases everywhere. So, as others say, good password safes seem to be the way to go.

The comic assumes that people go for predictable leetspeek substitutions because the system is forcing them to include non-alphanumerics. Which, indeed, many systems now do, and which, indeed, many users now do.

If I were evil and wanted to build a list of hard-to-guess passwords, I would put up a site like rumkin.com hoping that people would enter passwords that they planned to use. I'm not impugning rumkin, just saying. I probably wouldn't serve the password checker form via http though. I'm not that evil.

Will these passwords have to be entered manually? And if so, how difficult is it, mechanically, to enter a each character of the password? On a keyboard it's easy, but on a smartphone or console... not so much. The XKCD-style passwords are actually much easier to enter on a smartphone with either predictive text entry or something like Swype.

»It's kind of.. bullshit, honestly, to assume godlike knowledge of the password pattern chosen that reduces entropy by half.« Schneier once linked to a really nice article on how a popular password cracking tool works. The developers noted that a large portion of the non-dictionary passwords (which are of course found first) use only a few common schemes, usually a pronouncable-part suffix or prefix pronouncable part one. I don't think cutting the search space is entirely unjustified in this case. People are not necessarily creative when it comes to choosing a password that ...

... has to fit certain requirements. If the site requires you to add numbers and punctuation, well, add them to the end. If it requires upper-case characters – make the first one uppercase. It's actually quite predictable, alas I'd be hard-pressed to find actual studies right now.

Tim: I guess predictive text entry is usually off for password entry (at least on my phone). But yes, typing normal words is much easier on a phone than something with punctuation and letters.

John the ripper, one of the most popular password cracker, has all the rules used to create "troubadour" based password. Running it with all rules over dictionaries with words from 5 languages doesn't take even an hour on an average PC. While even 3 word combinations from single language are basically uncrackable.

You should read Thomas Pornin's updated answer.

@Gilles " If there isn't any low-hanging password fruit (and oh, there always is), they'll just move on to the next potential victim service"

@JeffAtwood John the Ripper is a pretty standard password cracking tool and finds Tr0ub4dor&3 after for few ¢ of EC2. Do you have data to support your assertion that attackers don't use such tools in practice?

@gilles well I wasn't really referring to that one, as basic letter-to-number sev7n style substitution is, admittedly, pretty mechanical if you do it totally consistently and repeatably. But passphrases are a different story. If I told you my password is "I live at 55 Maple Lane in Boston", show me the tool that will crack that in sane time using rules and not brute force. I'd love to see it, if you can. :)

@gilles as I said "In other words, will they actually attempt common schemes like "dictionary words separated by spaces", or "a complete sentence with punctuation", or "leet-speak numb3r substitution" as implied by xkcd?" So I will concede very basic leet-speek tables -- as Meat Loaf once said, Two out of Three Ain't Bad. But I won't concede anything else, unless you prove otherwise by cracking the above password for me! I eagerly await your results!

@JeffAtwood But that's the whole point of the comic, which your answer refutes: explaining that leet-speak transformations provide negligible security benefit while being significantly harder to memorize. A password like “I live at 55 Maple Lane in Boston” isn't more secure than “I live at fifty-five Maple Lane in Boston”, or “iliveatfiftyfivemaplelaneinboston” for that matter. They are all far too long for any password cracker (this is an 8-word passphrase, and even with the correlations between words, the entropy is high). Your “challenge” has nothing to do with the flaw in your answer.

@gilles well, I do agree that length is an issue in a realm of hardware cracking, see my blog post codinghorror.com/blog/2012/04/speed-hashing.html -- I used my own video hardware, two high end ATI 7970s.. but people ARE implying that pass phrases can be cracked more easily as a pattern just like l33tsp34k can.

This is such an old question but It's good. I'm curious though on how you determine charset size?

@JeffAtwood actually the xkcd is stating the exact opposite: passphrases are much harder to crack than any form of l33tsp34ked password, by order of magnitude. Contrast that with how much harder it is to remember the exact permutation, without adding sufficient benefit... So it seems from your comments that you are now concluding that the xkcd is correct, contrary to the implication in your answer?

@AviD Atwood didn't seem to change his position, i.e. contrary to the xkcd comic, "these specific two passwords are kind of a wash in practice". The study below indicates two more issues Atwood could add: With the comic's "four random common words", how random, and how common? "Users are clearly more random in “passphrase English” than in actual English, but unless it’s dramatically more random the underlying natural language simply isn’t random enough." The paper recommends Diceware (7776 words) lightbluetouchpaper.org/2012/03/07/…