https://securoxen.io/assets/why-strong-passwords-fail-BQ8OKXwx.js

1import{j as e,bs as l}from"./index-0qbe4j-K.js";import{P as c}from"./prose-CP3GO64z.js";import{b as i,L as n}from"./react-vendor-CuqwDvgQ.js";import{a as h}from"./logic-DpC-8Jkh.js";import{W as m}from"./widget-frame-BWiYKP5E.js";const p=1e11;function u(s){return s<=0?0:Math.pow(2,s-1)/p}const d=[{seconds:1,name:"second"},{seconds:60,name:"minute"},{seconds:3600,name:"hour"},{seconds:3600*24,name:"day"},{seconds:3600*24*365,name:"year"}],y=435e15;function g(s){if(s<1)return"instantly";if(s>y)return"longer than the age of the universe";let a=d[0];for(const o of d)s>=o.seconds&&(a=o);const r=Math.round(s/a.seconds);return`${r.toLocaleString()} ${a.name}${r===1?"":"s"}`}const w={"very weak":"bg-red-500",weak:"bg-orange-500",fair:"bg-yellow-500",strong:"bg-lime-500","very strong":"bg-emerald-500"},x=["P@ssw0rd!","Tr0ub4dor&3","correct horse battery staple","j8#mQ2vX!pL9zR4w"];function f(){const[s,a]=i.useState("P@ssw0rd!"),r=i.useMemo(()=>h(s),[s]),o=u(r.bits);return e.jsxs(m,{title:"Try it: how long would this take to crack?",hint:"type anything",children:[e.jsx("input",{type:"text",value:s,onChange:t=>a(t.target.value),spellCheck:!1,autoComplete:"off","aria-label":"Password to analyse",className:"border-border bg-background focus:border-primary mb-3 w-full rounded-lg border p-2.5 font-mono text-sm outline-none"}),e.jsx("div",{className:"mb-3 flex flex-wrap gap-2",children:x.map(t=>e.jsx("button",{type:"button",onClick:()=>a(t),className:"border-border hover:bg-muted rounded-md border px-2 py-1 font-mono text-[11px]",children:t},t))}),e.jsxs("div",{className:"mb-2 flex items-baseline justify-between text-sm",children:[e.jsx("span",{className:"font-medium capitalize",children:r.label}),e.jsxs("span",{className:"text-muted-foreground",children:[r.bits.toFixed(1)," bits"]})]}),e.jsx("div",{className:"bg-muted mb-3 h-2 w-full overflow-hidden rounded-full",children:e.jsx("div",{className:`h-full transition-all duration-300 ${w[r.label]}`,style:{width:`${Math.min(100,r.bits/128*100)}%`}})}),e.jsxs("p",{className:"mb-1 text-sm",children:["Cracked offline in"," ",e.jsx("strong",{className:o<3600*24?"text-red-500":"text-emerald-500",children:g(o)})]}),e.jsx("p",{className:"text-muted-foreground mb-3 text-xs",children:"Assuming 100 billion guesses per second - an ordinary GPU rig against a weakly hashed password database."}),r.warnings.length>0&&e.jsx("ul",{className:"space-y-1",children:r.warnings.map(t=>e.jsxs("li",{className:"flex items-start gap-1.5 text-xs text-amber-500",children:[e.jsx(l,{className:"mt-0.5 size-3 shrink-0"}),t]},t))})]})}function N(){return e.jsxs(c,{children:[e.jsxs("p",{children:[e.jsx("code",{children:"P@ssw0rd!"})," satisfies almost every password policy ever written. It has upper and lower case, a number, a symbol, and eight characters. It is also among the first few hundred guesses any real attacker makes."]}),e.jsx("p",{children:"The rules most sites enforce measure the wrong thing. Understanding what they measure - and what actually resists guessing - changes how you pick passwords."}),e.jsx("h3",{children:"Entropy is about the process, not the string"}),e.jsxs("p",{children:["Password strength is measured in bits of entropy, and entropy describes"," ",e.jsx("strong",{children:"how the password was chosen"}),", not how it looks. A truly random 8-character password from a 95-character set has about 52 bits. ",e.jsx("code",{children:"P@ssw0rd!"})," looks like it belongs in that set, but it was not chosen randomly - it was chosen by taking a dictionary word and applying substitutions everyone applies."]}

1),e.jsxs("p",{children:["Attackers know this. Cracking tools apply exactly those transformations to wordlists:"," ",e.jsx("code",{children:"a"})," to ",e.jsx("code",{children:"@"}),", ",e.jsx("code",{children:"o"})," to ",e.jsx("code",{children:"0"}),', capital first letter, digit and punctuation at the end. Against that, "password" and "P@ssw0rd!" are nearly the same guess.']}),e.jsxs("p",{children:["You can see the gap for yourself with the"," ",e.jsx(n,{to:"/tools/secret-strength",children:"Secret Strength Checker"}),": it reports the entropy of the character set you used, and separately flags the patterns - sequences, repeats, common passwords - that make the real number far lower than the arithmetic suggests."]}),e.jsx(f,{}),e.jsx("h3",{children:"Length beats complexity, by a lot"}),e.jsxs("p",{children:["Each extra character multiplies the search space by the size of the alphabet. Each extra character ",e.jsx("em",{children:"class"})," only widens the alphabet a little. So going from 8 to 16 characters helps enormously; adding a symbol to an 8-character password helps marginally."]}),e.jsx("p",{children:"This is why guidance changed. NIST's current recommendation drops mandatory composition rules and periodic expiry, and pushes length instead - because complexity rules mostly produce predictable passwords that are hard for humans and easy for machines."}),e.jsx("h3",{children:"Passphrases, if you must type it"}),e.jsx("p",{children:"For the handful of passwords you actually have to remember - your device login, your password manager's master password - use a passphrase built from randomly chosen words. Six words drawn randomly from a 7,776-word list gives roughly 77 bits: far stronger than any 8-character string, and far easier to type on a phone."}),e.jsxs("p",{children:['The word "randomly" is doing the work. Words you pick yourself are not random - people gravitate to the same nouns. The'," ",e.jsx(n,{to:"/tools/diceware-generator",children:"Diceware Generator"})," selects them with your browser's cryptographic RNG, which is the entire point."]}),e.jsx("h3",{children:"Everything else should be unmemorable"}),e.jsxs("p",{children:["For the other few hundred accounts, you should not know the password at all. Generate a long random string with the"," ",e.jsx(n,{to:"/tools/secure-generator",children:"Secure Generator"}),", let a password manager store it, and never see it again. Memorability is a constraint you only need where a human types the password unaided."]}),e.jsx("h3",{children:"Reuse is the failure that actually happens"}),e.jsx("p",{children:"Very few people are compromised because someone brute-forced a strong password. They are compromised because a password they used somewhere else appeared in a breach, and an attacker tried it against their email."}),e.jsxs("p",{children:["This is why a password can be strong and worthless at the same time. Check any password you reuse against ",e.jsx(n,{to:"/tools/pwned-password",children:"Pwned Password Check"})," - it compares against breach corpora using k-anonymity, so the password never leaves your browser. Any hit at all means retire it everywhere."]}),e.jsx("h3",{children:"What to actually do"}),e.jsxs("ol",{children:[e.jsx("li",{children:"Unique password per account, generated, stored in a manager."}),e.jsx("li",{children:"A long passphrase for the few you must type from memory."}),e.jsx("li",{children:"Two-factor authentication on email and anything financial - it defeats a stolen password outright."}),e.jsxs("li",{children:["Stop rotating passwords on a schedule. Rotate on evidence of compromise; forced rotation produces ",e.jsx("code",{children:"Summer2026!"})," then ",e.jsx("code",{children:"Autumn2026!"}),"."]})]})]})}export{N as default};