There is a search people make constantly: password ideas. It makes perfect sense — the form is sitting there, you have to invent something, and nobody has ever explained how it’s done.
The trouble is that the word ideas is already the mistake. A good password is not a good idea. It’s a password with no idea behind it.
That isn’t a nice line to open an article with. It’s literally how an attack works.
The list of ideas you’d come up with is the list he runs first
A dictionary attack doesn’t start at aaaaaaaa and count upwards. It starts with
the passwords that have already leaked by the million, moves on to first names,
common nouns, cities, football clubs and four-digit years. And on top of that
base it applies rules: capital at the front, a digit or a ! at the end, a for
@, e for 3, o for 0, the word backwards, the word twice.
Those rules are neither secret nor new. They’ve been written down for decades and they ship as standard in every cracking tool. Put another way: the catalogue of bright thoughts you’d call “password ideas” is, more or less in order, the config file of the person attacking you.
From here on, every figure comes from this site’s checker, which assumes an offline attack at 10¹² guesses per second against a fast hash. That assumption is printed under the result, and without it no time figure means anything. You can reproduce every number yourself: type the example and look.
Idea one: your name and the year you were born
Sarah1985. Nine characters, a capital, four digits. It satisfies what half the
internet demands.
The checker splits it in two at a glance: “It’s in our dictionaries” for
Sarah, “Looks like a year or a date” for 1985. The result is 159,000
guesses, which at that rate is less than a second.
Notice why it’s 159,000 and not an astronomical number. It isn’t that the password is short. It’s that it isn’t nine decisions, it’s two: which name and which year. Common first names run to a few thousand; the years people actually put in a password run to a few dozen. Multiply them and you’re done — you typed nine characters and picked from fewer than two hundred thousand possible passwords.
Idea two: swapping the a for an @
This is the trick everyone believes in, and the one that ages worst.
S@r@h1985 comes out at 308,000 guesses. It went up, yes: to exactly double.
And double nothing is still nothing — the checker still measures it in under
a second — because the substitution didn’t create a new password. It added one
binary question the attacker had already budgeted for: did this person swap the
a or not?
Look closely and the checker doesn’t even change its verdict. It still says “It’s in our dictionaries”, now with the note with numbers standing in for letters. It found the word anyway.
If you want to see how far this goes, try the canonical example. P@ssw0rd —
capital, at sign, zero, that whole air of having been thought about — falls in
17 guesses. Seventeen. You can count that on your fingers with a little
patience.
Idea three: writing it backwards
haras1985 comes out at 159,000 guesses. The same number, down to the last
digit, as Sarah1985.
It isn’t that reversal helps a little. It changes nothing whatsoever. Reversing the word is one of the rules the dictionary ships with, so the checker finds it just the same and labels it just the same, this time with the note written backwards.
The same goes for doubling it: SarahSarah drops to 2,983 guesses — typing
twice as many letters leaves you worse off than before, because “it repeats a
chunk” is a named pattern too.
Idea four: walking your fingers across the keyboard
When someone doesn’t want to think, they look at the keyboard and trace a shape.
Out comes qwerty123, or 1qaz2wsx, or 1q2w3e4r, or asdfghjkl.
It feels random because it means nothing. But a keyboard has a fixed and very small geometry, and tracing it is precisely what a program does better than you:
qwerty123→ 273 guesses.1qaz2wsx→ 29 guesses.
Twenty-nine. These are so well worn that the keyboard rules aren’t even needed: they show up verbatim in the leaked-password lists, and the checker flags them with a curt “It’s in our dictionaries”.
Idea five: the dog, and the date you’ll never forget
Toby2015! is a password with a biography: the dog’s name, the year he arrived,
and an exclamation mark to keep the form happy. It comes out at 1,2 × 10⁸
guesses, and it’s still less than a second.
The most common pet names number a few thousand, and they sit in the same lists
as human names. The trailing ! contributes what any rule everyone follows
contributes: nothing.
The meaningful date is worse still. 24121985 — a day, a month, a year — reads
like eight digits, but the checker labels it “Contains a date” and settles it in
14,966 guesses. The reason is the calendar: there are 31 days, 12 months and
a long century of plausible years. Eight digits that look like ten million
combinations are, in fact, about fifteen thousand.
That’s the trap in a date: it gives you length without giving you uncertainty, and uncertainty is the only thing that gets paid for.
Idea six: the number plate, and what the checker cannot see
4521KDR is different, and worth stopping on.
Here the checker says “We found no known pattern” and calculates 3,9 × 10¹⁰ guesses. But it flags that number as a ceiling, and that word is the important part: it didn’t find your pattern, which doesn’t prove you haven’t got one. Even so, and being generous, the time is still less than a second.
And there’s the gap you need to understand. The checker doesn’t know what car you drive. Someone who knows you, who has your Instagram open, or who bought a data dump with your plate in it, doesn’t need 3,9 × 10¹⁰ guesses: they need one. The number you see when there’s no pattern measures a stranger’s ignorance, not the ignorance of someone who went looking for you.
The same holds for your house number, your ID number, your phone and your wedding date.
What all six have in common
None of these ideas fails for being “not complex enough”. They all fail for the same reason: they are autobiography, and autobiography can be guessed. Your name, your year, your dog, your car, the way you trace a keyboard. Each of those decisions feels personal and yours, and that is exactly why it belongs to a short list somebody has already written down.
Adding complexity fixes nothing, because the complexity you apply is also a
decision of yours and also sits on the list. That’s why S@r@h1985 gains a
miserable factor of two and haras1985 doesn’t gain even that.
If you want the argument in numbers, it’s in entropy bits: what counts is not how many passwords you could have written, but how many are left once everything known about your tastes has been subtracted.
The way out isn’t a better idea: it’s having no ideas
The only way off the list is for the password not to come out of your head.
That is exactly what Diceware does: you roll five dice, look the number up in a list of 7,776 words, and write down whatever comes out. Each roll is worth 12.9 bits, and it’s a real 12.9, because dice have no tastes, no memory and no idea what year you were born. Six words come to roughly 77 bits.
Put one in the checker and watch what changes: six ordinary words picked by dice go from “Very Weak” to “Very Strong”, and the time stops being measured in seconds. Not because they’re convoluted — they aren’t, they’re six normal words — but because they’re the one part of your password you didn’t decide. If you’d rather the browser rolled for you, the generator runs the same draw and shows you the bits while it does it.
So the honest answer to “give me some password ideas” is that you don’t need any, and in fact you have too many already. What you’re missing is a die.
Sources: every figure in this article comes from the password.es checker, which declares its model under the result — 10¹² guesses per second, offline attack, fast hash — and all of them are reproducible by typing each example into /en/checker/ · the pattern-matching engine is zxcvbn, by Daniel Lowe Wheeler (Dropbox), presented at USENIX Security 2016 as “zxcvbn: Low-Budget Password Strength Estimation” · the substitution, reversal and repetition rules quoted here are the ones that ship as standard in dictionary-attack tools · Arnold G. Reinhold, “The Diceware Passphrase Home Page” (1995), for the 7,776 words and the 12.9 bits per roll.
Photo by RDNE Stock project · Pexels