Why is a password with both numbers and letters stronger than one with only letters? Attackers will include numbers in their brute force attempts anyway, so how does it make a difference?

Question

Why is a password with both numbers and letters stronger than one with only letters? Attackers will include numbers in their brute force attempts anyway, so how does it make a difference?

In: Technology

Answer 1

Try to guess a one-character-long password that uses only lowercase letters. You have a 1/26 chance (roughly 3.8%), because that’s how many lowercase letters there are (i.e. a-z).

Now add numbers, of which there are ten (i.e. 0-9). Your odds decrease to 1/36 (or ~2.8%) by adding numbers to the pool of letters.

You can continue this exercise with the addition of uppercase letters and symbols, and then ultimately by raising the length of the password from one character to many.

TL;DR: By increasing the number of possible characters, you’re making it harder for each one to be guessed.