Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically my knowledge in passwords consist of setting up a Diceware master password back then, and I know hashes are not convertible back to the original password.

Some basic question I want to know the answer for is how can a password be predicted from the hash? Like it can be known how many characters long it is exactly or at least roughly?

A newbie friendly crypto guide would be helpful. The beginner's guide was an issue on the Bitcoin S. E. board as well.

share|improve this question
If you're interested in learning the intrinsics of Bitcoin. I suggest starting at the technical paper: and looking up every term you don't know about yet. Note: this will take some time, so it's not if you just want to be sure your wallet is secure there are shorter paths. – Beanow Mar 20 '13 at 18:36

At the core of your question is a concept called entropy, which is the amount of uncertainty or unpredictability in a set of data.

In cryptography, entropy is related to probabilities, expressed in terms of powers of 2 (bits.) For example, a fair coin flip has one bit of entropy: it can be either heads (1) or tails (0). Flipping four coins gives you four bits. Rolling one six sided die gives you 2.6 bits of entropy, and so on. Ultimately, the number of bits of entropy represents the number of tries required to test every possible input (also known as a brute force attack.)

Be careful not to confuse a password with a hash of a password. A SHA-1 hash is 160 bits of data that looks very random, but isn't. If I were to tell my computer to guess every possible value for a SHA-1 hash ( $2^{160}$ ), it would take longer than forever. But that doesn't mean the hash value has 160 bits of entropy. If I know the hash value is the result of running a user's password through a SHA-1 algorithm, as an attacker I don't have to try all $2^{160}$ possible values. I just have to figure out all the values you might have chosen for a password, and run them through the hash algorithm myself.

Because users are humans, the passwords they choose are frequently based in their native language. If you're guessing the password of an English speaker, it's common to start with a list of frequently chosen passwords, such as "god", "admin", "root", "password", "abc123", etc, and then move on to testing all the rest of the words in an English dictionary. If a dictionary has 200,000 words in it, the entropy is only 18 bits, and it takes only a second or two for a computer to test all 200,000 possible dictionary words.

Note that password restrictions reduce the number of words I would have to test. If a password policy says "passwords must be 6 letters long", then I would first test all six letter dictionary words, which is faster than testing all 200,000 dictionary words. One thing we assume in all cryptosystems is that the attacker knows everything about the system in use, just not the values of the secrets involved.

Check out the wiki page I linked above for a fairly readable introduction to the concepts of entropy.

share|improve this answer

A good hash doesn't give you any information about password length or anything else. The only attack against such a hash is guessing the password, and then using the hash to verify if it was correct.

Depending on the hashing scheme, the cost per guess can vary widely. For example with plain MD5 a single graphics card can try several billion guesses per second. That's why we use slow schemes, like scrypt, bcrypt or PBKDF2.

share|improve this answer
A good hash. But i guess most sites use a bad one, like 95% of them, right? And from a bad hash can you guess about the length? Ps. End a line with two spaces to add a <br/> linebreak: This doesn't work all the time. – superuser Jan 7 '13 at 15:23
@superuser In this respect pretty much any hash used in practice is good(even MD5). Only really bad homebrew hashes would be vulnerable to that. Using fast hashes or not salting are the two common issues. | PS. you can't use line breaks in comments, only in questions and answers. – CodesInChaos Jan 7 '13 at 15:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.