Let's assume that the password to be cracked is 15 characters long and consists of numbers (to keep the math simple). Let's assume the attacker has the following information about the password:

  • It is at least 8 characters long
  • It consists of numbers.
  • It is random

What is the maximum number of combinations the attacker must try? If he knew the actual password length, there would be 1015 possible combinations. Since he does not know the password length, would he also have to try all shorter passwords too(108+109+1010+1011+1012+1013+1014+1015=1,1111111x1015)?


1 Answer 1


Yes, almost. That's close enough to the order of password to test when e.g. looking at a 2-exponential scale such as strength in bits.

If the characters are decimal digits then you'd have to test them all to get to the maximum number of combinations. Well, except for one since if you have tested all the rest then there is only one possibility left, which you would not have to test. If there are 3 murder suspects and you know that two could not have done it...

Furthermore, this presumes that there are no tricks to get information about the passwords otherwise. If there is an oracle that can indicate the size of the password then this calculation would be upset. It is pretty easy to do a direct comparison and have the equation fail at the first incorrect character for instance, in which case the password would be very easy to obtain.

And I'm assuming that random really is random of course. That's as stated so I'll take that at face value.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.