Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
    1. COThe diceware algorithm (http://world.std.com/~reinhold/diceware.html) does none of these except the last ("A length of at least six characters"), yet with a 6 word password has 77 bits of entropy -- pretty respectable.
      singulars
    2. COIf at all possible, I avoid using any system that arbitrarily imposes most or all of the metrics defined here. To anyone designing a password strength checker, please keep in mind that some of your users have evolved from pass*word*s to pass*phrase*s. One of my throwaway passphrases is 38-characters long, all lowercase, and has 170 bits of entropy. The Sun will burn out before it could be cracked, even by our planet's fastest supercomputer. By contrast, it'd take about 15 minutes for a desktop PC to crack a password that just meets the above requirements.
      singulars
    3. COI'd also like to clarify: suggesting the above metrics to the user and using a strength meter are perfectly acceptable -- just don't force me to tick off a list of required character types. [It doesn't make my password more secure and it only makes it harder to remember](http://xkcd.com/936/). Also, don't restrict me to 8 or 12 or 16 characters -- you should be storing a password hash anyway, so the length of my actual password is irrelevant; Hashing a six-character password and a 600-character passphrase with SHA1 both result in a 40-character hash 100% of the time, every time.
      singulars
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload