936: Password Strength - Revision history

DollarStoreBa'al at 14:40, 9 April 2026

2026-04-09T14:40:05Z

Duralumin-here: /* Transcript */ another typo

2025-11-12T23:05:41Z

‎Transcript: another typo

Duralumin-here: /* Transcript */ typo

2025-11-12T23:04:27Z

‎Transcript: typo

Duralumin-here: /* Transcript */

2025-11-12T23:01:01Z

‎Transcript

162.158.172.38: /* Explanation */

2024-12-25T19:20:38Z

‎Explanation

Dtgriscom: Removing conversational "Sigh."

2024-07-26T20:22:01Z

Removing conversational "Sigh."

162.158.178.26: A password space of size 2^X has an entropy of X, and 2^0 = 1. If the hacker as assumed in the comic knows your password selection method is to just use "CHBS"(as no randomization is mentioned in this example), they would directly know your password.

2024-07-07T10:38:51Z

A password space of size 2^X has an entropy of X, and 2^0 = 1. If the hacker as assumed in the comic knows your password selection method is to just use "CHBS"(as no randomization is mentioned in this example), they would directly know your password.

Tsuchinoko: /* People who don't understand information theory and security */

2024-01-29T00:12:01Z

‎People who don't understand information theory and security

162.158.74.59: Undo revision 325811 by 198.41.230.52 (talk) No, the Ampersand is one of the characters, not just "Tr0ub4dor" and "3"

2023-10-13T23:21:14Z

Undo revision 325811 by 198.41.230.52 (talk) No, the Ampersand is one of the characters, not just "Tr0ub4dor" and "3"

198.41.230.52: /* Explanation */

2023-10-13T22:33:59Z

‎Explanation

@@ Line 22: / Line 22: @@
 xkcd's password generation scheme requires the user to have a list of 2048 common words (log<sub>2</sub>(2048) = 11). For any attack we must assume that the attacker knows our password generation algorithm, but not the exact password. In this case the attacker knows the 2048 words, and knows that we selected 4 words, but not which words. The number of combinations of 4 words from this list of words is (2<sup>11</sup>)<sup>4</sup> = 2<sup>44</sup>, i.e. 44 bits. For comparison, the [https://world.std.com/~reinhold/dicewarefaq.html#calculatingentropy entropy offered by Diceware's 7776 word list is 13 bits per word]. If the attacker doesn't know the algorithm used, and only knows that lowercase letters are selected, the "common words" password would take even longer to crack than depicted. 25 ''random'' lowercase characters would have [https://www.wolframalpha.com/input/?i=log2%2826^25%29 117 bits of entropy], vs 44 bits for the common words list.
 ;Example
 Below there is a detailed example which shows how different rules of complexity work to generate a password with supposed 44 bits of entropy. The examples of expected passwords were generated in random.org.(*)

@@ Line 103: / Line 103: @@
 :Difficulty to guess: Easy
-:[Cueball stands scratching his head trying to remember the password.]
+:[Cueball stands scratching his head, trying to remember the password.]
 :Cueball: Was it trombone? No, Troubador. And one of the O's was a zero?
 :Cueball: And there was some symbol...
@@ Line 119: / Line 119: @@
 :Observer: ''Correct!''
 :Difficulty to remember: You've already memorized it
-:[Caption below the whole comic:]
+:[Caption beneath the whole comic:]
 :Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

@@ Line 119: / Line 119: @@
 :Observer: ''Correct!''
 :Difficulty to remember: You've already memorized it
-:[Caption below the panel:]
+:[Caption below the whole comic:]
 :Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

@@ Line 89: / Line 89: @@
 ==Transcript==
-:The comic illustrates the relative strength of passwords assuming basic knowledge of the system used to generate them.
+:[The password "Tr0ub4dor&3" is shown in the center of the panel. In this panel and multiple others, a set of squares is used to indicate how many bits of entropy a section of the password provides. A line from each annotation indicates the word section the comment applies to.]
-:A set of boxes is used to indicate how many bits of entropy a section of the password provides.
+:Uncommon (non-gibberish) base word ["Tr0ub4dor" is indicated to have 16 bits of entropy.]
-:The comic is laid out with 6 panels arranged in a 3x2 grid.
+:Caps? ["T" is indicated to have 1 bit of entropy.]
-:On each row, the first panel explains the breakdown of a password, the second panel shows how long it would take for a computer to guess, and the third panel provides an example scene showing someone trying to remember the password.
+:Common substitutions ["0", "4", and "o" are indicated to have 3 bits of entropy in total.]
+:Punctuation ["&" is indicated to have 4 bits of entropy.]
-:[The password "Tr0ub4dor&3" is shown in the center of the panel. A line from each annotation indicates the word section the comment applies to.]
+:Numeral ["3" is indicated to have 3 bits of entropy.]
+:Order unknown ["&" and "3" are indicated to have 1 bit of entropy.]
 :(You can add a few more bits to account for the fact that this is only one of a few common formats.)
-:~28 bits of entropy
+:~28 bits of entropy [These are represented by all 28 squares from the previous panel being redrawn in this one.]
 :2<sup>28</sup> = 3 days at 1000 guesses/sec
 :(Plausible attack on a weak remote web service. Yes, cracking a stolen hash is faster, but it's not what the average user should worry about.)
@@ Line 120: / Line 108: @@
 :Difficulty to remember: Hard
-:[The passphrase "correct horse battery staple" is shown in the center of the panel.]
+:correct horse battery staple [Each word in the proposed password is indicated to have 11 bits (squares) of entropy.]
-:Four random common words {Each word has 11 bits of entropy.}
+:Four random common words
-:~52 bits of entropy
+:~44 bits of entropy [As before, these bits are represented by all 44 squares from the previous panel being redrawn]
 :2<sup>44</sup> = 550 years at 1000 guesses/sec
 :Difficulty to guess: Hard
-:[Cueball is thinking, in his thought bubble a horse is standing to one side talking to an off-screen observer. An arrow points to a staple attached to the side of a battery.]
+:[Cueball is thinking. His thought bubble shows a horse on the left talking to an off-screen observer. An arrow points to a staple attached to the side of a battery.]
 :Horse: That's a battery staple.
 :Observer: ''Correct!''
 :Difficulty to remember: You've already memorized it
+:[Caption below the panel:]
 :Through 20 years of effort, we've successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

@@ Line 16: / Line 16: @@
 Another way of selecting a password is to have 2048 "symbols" (common words) and select only 4 of those symbols. log2(2048^4) = 44 bits, much better than 28. Using such symbols was again visited in one of the tips in [[1820: Security Advice]].
-It is absolutely true that people make passwords hard to remember because they think they are "safer", and it is certainly true that length, all other things being equal, tends to make for very strong passwords and this can be confirmed by using [https://rumkin.com/tools/password/passchk.php rumkin.com's password strength checker]. Even if the individual characters are all limited to [a-z], the exponent implied in "we added another lowercase character, so multiply by 26 again" tends to dominate the results.
+It is absolutely true that people make passwords hard to remember because they think they are "safer", and it is certainly true that length, all other things being equal, tends to make for very strong passwords and this can be confirmed by using [https://rumkin.com/tools/password/passchk.php rumkin.com's password strength checker]. Even if the individual characters are all limited to [a-z], the exponent implied in "we added another lowercase character, so multiply by 26 again" tends to dominate the results. That's before using ''all'' symbols of [https://www.ascii-code.com/ ascii], [https://www.ascii-code.com/ html] and [https://symbl.cc/ru/unicode-table/#cjk-unified-ideographs-extension-b unicode].
 In addition to being easier to remember, long strings of lowercase characters are also easier to type on smartphones and {{w|Virtual keyboard|soft keyboards}}.

@@ Line 86: / Line 86: @@
 * Ken Grady incorrectly thinks that user-selected sentences like "I have really bright children" have the same entropy as randomly-selected words: [https://www.hellersearch.com/blog/bid/141527/is-your-password-policy-stupid Is Your Password Policy Stupid?]
 * Diogo Mónica is correct that a truly random 8-character string is still stronger than a truly random 4-word string (52.4 vs 44), but doesn't understand that the words have to be truly random, not user-selected phrases like "let me in facebook":  [https://diogomonica.com/posts/password-security-why-the-horse-battery-staple-is-not-correct/ Password Security: Why the horse battery staple is not correct]
-* Ken Munro confuses entropy with permutations and undermines his own argument that "correct horse battery staple" is weak due to dictionary attacks by giving an example "strong" password that still consists of English words. He also doesn't realize that using capital letters in predictable places (first letter of every word) only  increases password strength by a bit (figuratively and literally): [https://www.pentestpartners.com/security-blog/correcthorsebatterystaple-isnt-a-good-password-heres-why/ CorrectHorseBatteryStaple isn’t a good password. Here’s why.]
+* Ken Munro confuses entropy with permutations and undermines his own argument that "correct horse battery staple" is weak due to dictionary attacks by giving an example "strong" password that still consists of English words. He also doesn't realize that using capital letters in predictable places (first letter of every word) only  increases password strength by a bit (figuratively and literally): [https://www.pentestpartners.com/security-blog/correcthorsebatterystaple-isnt-a-good-password- heres-why/ CorrectHorseBatteryStaple isn’t a good password. Here’s why.]
 ==Transcript==

@@ Line 64: / Line 64: @@
 |-
 |correct&#8203;horse&#8203;battery&#8203;staple
-|1
+|0
-|Thanks to this comic, this is now one of the first passwords a hacker will try. The only entropy left is a boolean statement: "Is this password correct&#8203;horse&#8203;battery&#8203;staple, yes or no?"
+|Thanks to this comic, this is now one of the first passwords a hacker will try.
 |}

@@ Line 8: / Line 8: @@
 ==Explanation==
-This comic says that a password such as "Tr0ub4dor3" is bad because it is easy for password cracking software and hard for humans to remember, leading to insecure practices like writing the password down on a post-it attached to the monitor. On the other hand, a password such as "correct horse battery staple" is hard for computers to guess due to having more entropy but quite easy for humans to remember.
+This comic says that a password such as "Tr0ub4dor&3" is bad because it is easy for password cracking software and hard for humans to remember, leading to insecure practices like writing the password down on a post-it attached to the monitor. On the other hand, a password such as "correct horse battery staple" is hard for computers to guess due to having more entropy but quite easy for humans to remember.
 {{w|Entropy (information theory)|Entropy}} is a measure of "uncertainty" in an outcome. In this context, it can be thought of as a value representing how unpredictable the next character of a password is. It is calculated as ''log2(a^b)'' where ''a'' is the number of allowed symbols and ''b'' is its length.