# password generation: random length or max length

In short:

Is it cryptographically stronger to have a known length password of the maximum length allowed, or a random length password somewhere in the range of the longest length possible?

Does the answer change depending on the max length? For instance my credit union (still!) forces a maximum length of 10 characters. Would it be better to utilize all 10 if an attacker knew that that was the length I used, or would it be better to randomly use a length of either 9 or 10. What if my credit union allowed a length of 16? Or a length of 255?

-
the longer the better. also the more unpredictable the better, ideally the password should be a string of random characters –  Richie Frame Nov 26 '13 at 2:36

Having a random length makes very little total difference in the entropy of your password compared to the entropy you would get using just the maximum length allowed. This is because there are a lot more passwords of, say, length 10 than any shorter length (in fact, there are more 10-character passwords than any other shorter password). So if your attacker has the ability to brute force 10-character passwords, he can easily brute-force passwords from 1 to 10 characters with more or less the same amount of work.

To justify why they do this, let's get some numbers. For instance, assume a charset of 96 symbols (typical ASCII + special characters stuff). How many 10-character passwords are there?

Answer: $96^{10} \approx 6.64 \times 10^{19}$

Now how many passwords of length shorter than 10 are there:

Answer: $\sum_{k = 1}^9 96^k \approx 7 \times 10^{17}$

And so:

$$\frac{\text{Number of passwords length less than 10}}{\text{Number of 10-character passwords}} = \frac{7 \times 10^{17}}{6.64 \times 10^{19}} \approx 0.01$$

What does this mean? It means that if someone took, say, one year to search through all 10-character passwords, it would only take him about 4 days to search through all passwords of length 1 to 9. Clearly, that person might as well search them too if he isn't sure of the length, for very little additional cost. And he may as well do them first to spare himself a year of waiting in case you picked one of the shorter passwords.

You can do the math for other lengths and charsets, and you'll see that in general, it's not worth it.

To conclude, if an opponent has the ability to brute force passwords of length $l$, then picking a random password of length between $k$ and $l$ where $k < l$ offers very little additional protection, and may in fact decrease security as shorter passwords are generally searched first.

-
Whether or not it will decrease security depends on how you choose your passwords. If you first choose a length uniformly at random, and then a password of that length, then you decrease security. If you choose your password uniformly at random from all possible passwords of length up to $l$, then you do not decrease security. –  K.G. Nov 26 '13 at 10:22
@K.G. Quite true, and worth pointing out, though the increase in security is still negligible. –  Thomas Nov 26 '13 at 10:24
Oh yes. There's no point in complicating password generation by allowing shorter passwords. The risk that some mistake will mess things up is far greater than the microscopic benefit. –  K.G. Nov 26 '13 at 10:33