Why is a password with both numbers and letters stronger than one with only letters? Attackers will include numbers in their brute force attempts anyway, so how does it make a difference?

Question

Why is a password with both numbers and letters stronger than one with only letters? Attackers will include numbers in their brute force attempts anyway, so how does it make a difference?

In: Technology

Answer 1

Imagine creating a password that is 2 letters long and can only contain the letters “a” and “b”.

How many can you create? Four: “aa”, “ab”, “ba”, “bb”. It’s very easy for a hacker to guess your password if they only need 4 tries.

Now change the rules to allow using “a”, “b” or any number (0-9). How many passwords can you now create? A lot more: “aa”, “a0”, “a1”, “a2”, “b3”, “44”, “8b”, “bb”, etc. (144 to be exact). This is a lot harder to guess.

Now think about how many tries you need to guess if you can use any letter a-Z, and any number for any length of password. It grows so fast that eventually a computer can’t guess it in a billion years (with current tech at least).