# Elaborate more on passphrase length and strength **URL:** https://discuss.privacyguides.net/t/elaborate-more-on-passphrase-length-and-strength/15550 **Category:** Guide Suggestions **Created:** 2023-12-12T10:32:20Z **Posts:** 25 ## Post 1 by @anon28734771 — 2023-12-12T10:32:20Z 7 word diceware passphrase, 18 characters of random letters and numbers, 90 bits of entropy, etc are considered secure against any brute force attack. But should we really recommend everyone to use passwords that long? I don’t think so. But right now, we do: > We recommend securing your password manager with a [diceware passphrase](https://www.privacyguides.org/en/basics/passwords-overview/#diceware-passphrases) comprised of at least seven words. My proposal: We should educate the reader to allow them to generate a passphrase that suits their threat model, instead of just making them use passphrases that can’t be brute forced by anyone in the current day of age. Thoughts? --- ## Post 3 by @anon85295620 — 2023-12-12T11:15:32Z I use Bitwarden’s Password Strength Testing Tool [Password Tester | Test Your Password Strength | Bitwarden](https://bitwarden.com/password-strength/) to see if my passphrase is strong enough. I found just two or three words, spelt incorrectly, is strong enough. I can imagine how annoying it would be to type 7 words that I can’t see (password entries are typically hidden, but can be shown) on a phone keyboard. Now, I have to stop and examine those words for misspelling. If I forget and hit enter and it’s wrong, all 7 words need to be typed again. --- ## Post 4 by @anon28734771 — 2023-12-12T11:18:53Z > [@anon85295620](#): > > I can imagine how annoying it would be to type 7 words that I can’t see (password entries are typically hidden, but can be shown) on a phone keyboard. Now, I have to stop and examine those words for misspelling. If I forget and hit enter and it’s wrong, all 7 words need to be typed again. It is mentally draining, and I used it in the past because I thought I need this to be secure, but in reality this is overkill for almost everyone in the world. --- ## Post 5 by @moonwriting — 2023-12-12T11:25:52Z It depends on what you are securing. For example, we know that Bitwarden uses either PBKDF2 or Argon2, which means that you can safely use even a 4-word passphrase as the [calculator](https://passwordbits.com/passphrase-cracking-calculator/) by Passwordbits demonstrates. However, for most sites, we don’t know how they implement these things, and thus, using a 7-word passphrase could still be justified. But for most sites, you should probably just use a randomly generated password instead if you never have to type it out yourself. --- ## Post 6 by @anon28734771 — 2023-12-12T11:30:04Z > [@moonwriting](#): > > However, for most sites, we don’t know how they implement these things, and thus, using a 7-word passphrase could still be justified. Well, you only need them for a password manager, your devices, encryption, etc. For registration on sites and everywhere else, generating random passwords in a password manager is the way to go. --- ## Post 7 by @jonah — 2023-12-12T18:41:56Z 3 posts were split to a new topic: [Add biometrics guidance to website](/t/add-biometrics-guidance-to-website/15563) --- ## Post 8 by @anon29374801 — 2023-12-12T16:21:56Z > [@anon28734771](#): > > We should educate the reader to allow them to generate a passphrase that suits their threat model, instead of just making them use passphrases that can’t be brute forced by anyone in the current day of age. My only issue with this is that “threat model” is completely subjective and that it takes people a long time to really understand what a threat model is and how it applies to them. I would like to see some sort of “rule of thumb” suggestions included such as 50+ characters for master passwords, 20+ characters for banking passwords for example. --- ## Post 9 by @xe3 — 2023-12-12T18:46:41Z > [@anon85295620](#): > > I found just two or three words, spelt incorrectly, is strong enough. This is not a safe practice. The password strength testers are good at testing randomly generated passwords, not so good at estimating the strength of non-random passwords like this. Things like misspellings may trick the password test but may or may not meaningfully increase the strength of the password, it is best not to count on it, as many of the common ‘tricks’ people use are not that difficult from a cracking algorithms point of view. A password that is 2-3 misspelled words has a “length” of 2-3 words, not a length of however many characters. Assuming a 2 word random password generated by Bitwarden the strength is: log₂(7776²) = 25 bits of entropy That makes it just slightly _weaker_ than a 4 character random password: log₂(95⁴) = 26 bits of entropy Within the Bitwarden (and I believe 1 pass) community it seems like 4-7 words seems to be the generally agreed upon sweet spot that should suit most people. (this is for the mast passphrase, for everything else just use a strong randomly generated password) > I would like to see some sort of “rule of thumb” suggestions included such as 50+ characters for master passwords, 20+ characters for banking passwords for example. 1. Your master pass should be unique, complex, and random. - Random, as in randomly generated, not thought up by you. - Unique, as in your master password should not be used as a password for any other accounts - Complex, as in the wordlist or characterset should be sufficiently big (use Bitwarden, or 1password’s generators, or diceware 2. Passphrases are recommended for master passwords not because they are stronger, but because they are easier for us humans to remember and type, than a randomly generated password. 3. A target passphrase length of 4-7 words is probably reasonable for most people (50-90 bits of entropy), \>7 words if you are extra cautious, but exceeding 10-12 words will have little to no practical value. 4. While you can use ‘tricks’ to harden your master passphrase further, you should not rely on those tricks, the password should be strong enough on it’s own, even if you assume the attacker knows everything about how the password was generated (this is called Kerckhoffs Law, and is a standard assumption). 5. For your other passwords, use your password managers random generator, a good target is at least 14+ characters, exceeding ~20-30 characters has little to no practical value in most cases, but also no ‘cost’ as you don’t have to type these passwords manually. 6. For your password manager and for any other important account that allows it, you should enable 2FA. 7. You should have a strategy for backing up your password vault. 8. Biometrics have pros/cons. You should look into on your own. One thing to be aware of is that in some countries like the United States you cannot be legally compelled to divulge a password/phrase, but you can be legally compelled to unlock via biometrics. > suggestions included such as 50+ characters for master passwords, 20+ characters for banking passwords for example. This indicates to me that you are may be thinking about passwords in an unsafe way. Because almost no human can remember a 50 character randomly generated password, I suspect you are thinking of a pass_phrase_ (a password made up of words) but measuring its length in characters which gives a false sense of security. When estimating a strength of a pass_phrase_ you count the words not the characters because an adversary would use a wordlist, and the passphrase would be cracked using a wordlist long before it would be cracked using characters. For reference a strong 6 word passphrase is roughly equivalent in strength to a strong 12 character password, a 4 word passphrase is roughly equivalent to a strong 8 character password. --- ## Post 10 by @jonah — 2023-12-12T18:51:06Z > [@anon28734771](#): > > But should we really recommend everyone to use passwords that long? Meeting the **minimum** standard for password security is not a matter of threat modeling. There are _some_ universal threats on the internet by virtue of being connected to everybody on Earth, and I don’t think we can rightly recommend anything weaker than these minimum specifications. --- ## Post 11 by @anon29374801 — 2023-12-12T19:32:39Z > [@xe3](#): > > This indicates to me that you are may be thinking about passwords in an unsafe way. Because almost no human can remember a 50 character randomly generated password Sorry I meant for those examples to be examples of “rules of thumb” not as anything someone should use as a guideline for passwords. I should of worded my thoughts more clearly. > [@xe3](#): > > measuring its length in characters which gives a false sense of security. When estimating a strength of a pass_phrase_ you count the words not the characters because an adversary would use a wordlist, and the passphrase would be cracked using a wordlist long before it would be cracked using characters. For reference a strong 6 word passphrase is roughly equivalent in strength to a strong 12 character password, a 4 word passphrase is roughly equivalent to a strong 8 character password. This a great bit of info though! --- ## Post 12 by @crossroads — 2023-12-12T19:57:38Z If I need password I should remember without pass manager, I use 3-5 words in 2-4 different languages, plus number and at least one capital letter --- ## Post 13 by @xe3 — 2023-12-12T20:03:03Z For anyone interested in the math, here is the basic formula for measuring a password/phrase’s entropy: Entropy = `log2(Rᴸ)` (where `R = the characterset or wordlist` (e.g. 26 for just lowercase letters, 95 for all symbols on a keyboard, or 7776 for bitwarden’s wordlist and `L = length of characters or words`) So for example a `5` word passphrase from a `7776` word list would be: `log₂(7776⁵) = 64 bits` You don’t have to use the formula in practice, but understanding it and playing around with it a bit will give you a more intuitive understanding of the _two dimensional nature of password strength_ (password length and character/word set) My memory is rusty on how key derivation functions apply. IIRC if you use PBKDF2 (which was the standard until recently) the forumula is `Equivalent Entropy = log2(Rᴸ) + log₂(iterations)` where iterations are the number of PBKDF2 iterations. So sticking with our same example above but adding 600k iterations: `log₂(7776⁵) + log₂(600000) = 83 bits` in other words 600k PBKDF2 iterations would add the equivalent of 19 bits of entropy to the 5 word passphrase (if I am remembering correctly, and got the math right, please doublecheck before relying on it) edit: and for those who’s eyes glaze over at the mention of Math, a less technical and more intuitive way to quantify password strength is estimating [_cost to crack_](https://blog.1password.com/cracking-challenge-update/) --- ## Post 14 by @anon28734771 — 2023-12-12T20:21:33Z The minimum would be a 4 word diceware passphrase, 7 word diceware passphrase is the maximum, and everything beyond that is just silly. I would like to know where did this “standard” originally came from and why you consider it to be the minimum. [@xe3](https://discuss.privacyguides.net/u/xe3) already linked a good blog post that I wanted to share, but he was faster, which shows how much would it cost to crack a passphrase or a password. > **[How strong should your account password be? Here's what we learned | 1Password](https://blog.1password.com/cracking-challenge-update/)** > > How much effort would a hacker need to put in to crack a 1Password account password? Here’s what we learned after running some community challenges. This blog post shows what lenght of a passphrase is actually reasonable to use for 99% of people. --- ## Post 15 by @anon29374801 — 2023-12-12T20:23:26Z I am a reasonable guy I am willing to save hackers some cash and sell you my master password for just half a trillion dollars. --- ## Post 16 by @xe3 — 2023-12-12T21:31:08Z > [@anon28734771](#): > > The minimum would be a 4 word diceware passphrase, 7 word diceware passphrase is the maximum, and everything beyond that is just silly. FWIW my recommendation of a 4-7 word range is based on what makes sense as a target range “for most people”. I think most everyone will find a point in that range that is sufficient for them, but at the same time the lower end of that range may not be (or _feel_) sufficient for some people. So while this is the general guidance I tend to give people, and the cost to crack a 4 word passphrase is still immense, for this community specifically I can understand giving slightly more conservative guidance, since by nature or by necessity we tend to fall on the more conservative/cautious side of the spectrum here. I personally prefer giving a range that gives people an indication of a reasonably secure minimum, and a reasonably practical upper limit rather than a specific recommendation, but I can also understand why a site like PG would choose a recommendation towards the top end of my range if they are going to give a specific concrete recommendation (“7 words minimum”) as opposed to a range. Communicating password strength and good password hygiene is a surprisingly hard thing to do. I do not envy those who have to formally give recommendations to a broad audience on this subject. * * * Many people have a better intuitive understanding of password strength in characters than password length in words, here are some rough equivalents (assuming 95 character set / 7776 word list, and randomly generated passwords): 3 words = 6 characters = ~35-40 bits 4 words = 8 characters = ~50 bits 5 words = 10 characters = ~65 bits 6 words = 12 characters = ~75-80 bits 7 words = 14 characters = ~90 bits […] 10 words = 20 characters = exceeds the strengths of a 128 bit encryption key 20 words = 40 characters = exceeds the strength of a 256 bit encryption key --- ## Post 17 by @anon32876053 — 2023-12-17T09:24:37Z I have been using password managers over the decades, the thing I notice, is the minimal length is an unsafe betting scheme, simple reason been is your belief, will the password hold, what is minimal length today, is a hack tomorrow. I have seen the minimal length scale up in lengths over the decades to it current length at present. You’re using a password manger for a reason, stop hobbling the program with minimal length passwords, in time you’re going to change those minimal length passwords again and again. Personally, for me, passphrase with lengths of 7–9 words were possible, since I have no intentions of remembering these passwords. Expert agreed that increasing the length of a password is much more important than adding complexity requirements, such as mandating the use of numbers, letters, and symbols. But even more important is ensuring that the password is truly random. Do you want security or chance? --- ## Post 18 by @anon66226834 — 2023-12-28T11:58:12Z Based on the recommendation of [Kicksecure](https://www.kicksecure.com/wiki/Passwords#Classical_Computing_Attack), a 7-word passphrase is recommended against classical computing attacks. 1Password has an advantage that other password managers don’t. They have a secret key function, which is why it’s still secure even if they use a 4-word Passphrase. --- ## Post 19 by @anon39565454 — 2023-12-28T13:27:56Z > [@xe3](#): > > Assuming a 2 word random password generated by Bitwarden the strength is: > log₂(7776²) = 25 bits of entropy > > That makes it just slightly _weaker_ than a 4 character random password: > log₂(95⁴) = 26 bits of entropy This is where you invent fake words, or add few random letters/numbers. --- ## Post 20 by @anon39565454 — 2023-12-28T13:31:02Z Idk where you get that really small 7776 word list The english language alone contains at least a million words. [How many words are there in English? | Merriam-Webster](https://www.merriam-webster.com/help/faq-how-many-english-words) So your math ia already wrong --- ## Post 22 by @anon66226834 — 2023-12-28T13:34:27Z The word list is based on the [EFF word list](https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt) which consist of 7776 words. --- ## Post 23 by @anon39565454 — 2023-12-28T16:23:46Z It’s a really _really_ small wordlist, doesn’t even have basic words like `keyboard` or `question` or `weird`. This also does not include typos, even adding a single alphabet to the end(eg. `abacusa` `abacusb` `abacusc` etc) already increased the wordlist by 7776\*26=202176. You also need to include every possible permutation of caps lock. Have I mentioned adding numbers? This is why I’m saying that the math is wrong (also, just adding a single made up word not on the list will turn the whole dictionary attack useless) Edit: cracking with that list will also fail “[correct horse battery staple](https://xkcd.com/936/)” --- ## Post 24 by @xe3 — 2023-12-28T17:28:28Z > Idk where you get that “really small” 7776 word list It is the most commonly used wordlist length. The 7776 wordlist is what Bitwarden and KeepassXC use, it comes from the EFF large wordlist (also 7776 words), which is based on the Diceware lists (also 7776 words). Many (but not all) password managers and password generators use this list length. > So your math ia already wrong You seem to be missing the point of the math. Math is not wrong because a variable could be different. The math doesn’t produce set in stone numbers, it differs based on the variables, I chose to use two of the most commonly used values (7776 wordlist, 95 characterset) for my examples. And I [made clear](https://discuss.privacyguides.net/t/elaborate-more-on-passphrase-length-and-strength/15550/13) (or tried to) that both password length and characterset/wordlist length are variables/inputs that you change to fit your scenario). If you haven’t understood that you adjust those inputs to fit your situation, you haven’t understood the math. That absolutely doesn’t “make the math wrong” The math works, you just need to use the correct variables for your situation. > This is where you invent fake words This is both true, and also poor advice to rely on for a strong password. Humans are poor sources of randomness, poor judges of password strength, that is the whole point of using random mathematically complex passwords that are not human created. Using a fake word _as part of an already strong password_ is a fine idea, but _relying_ on a fake word _alone_ or other tricks to make your password strong is less secure. (ironically, that is a big part of what the comic you linked to is intending to explain) --- ## Post 25 by @anon39565454 — 2023-12-30T04:34:06Z What I’m arguing against is you using the input (7776 wordlist) to also argue against typos, fake words, and other factors when you know really well that even adding a single one of those will either completely break dictionary attack or at the very least exponentially increase the potential combination > [@xe3](#): > > A password that is 2-3 misspelled words has a “length” of 2-3 words, not a length of however many characters. > > Assuming a 2 word random password generated by Bitwarden the strength is: > log₂(7776²) = 25 bits of entropy Of course, because the equation is exponential, longer passwords are almost always safer than short passwords. But 2-3 misspelled words already exploded the amount of words the dictionary needs to check, making the original 7776 equation not apply. eg. > [@anon39565454](#): > > even adding a single alphabet to the end(eg. `abacusa` `abacusb` `abacusc` etc) already increased the wordlist by 7776\*26=202176 This does not letter deletion and permutation. Yes, humans are a bad source of true randomness. But I don’t think we’re at a point where password crackers could accurately predict human randomness Only conclusion I think we can actually get from the 7776 words variable is, don’t use short **default generated** passwords