BleepingComputer.com: Password Strength Checker

Gives an indication of how long it will take to crack your password, and how much you can increase the strength by adding one or more stray characters.

http://www.howsecureismypassword.net/

Interesting.
Tried a password like I usually use (11 character):

Quote

I can live with that.

Very neat - I see that I need to change a couple of my passwords!

I have a question. I sent the link to a friend, but he is very leary of typing in an actual password, which is surely understandable. I can see where a "similar" password would be safer to try. After reading through the FAQ in the link, it does sound "safe" to try a real password, but I'm just not really sure about this.


What are your thoughts/recommendations on this please?

Thanks, Keith

Give your friend a cookie for being so security conscious! I found nothing nefarious on the page but it's still smart to not hand out your passwords. A similarly constructed password should give the same answers, though: if his password were "bob123" for example, he could test "sue432" and get the same result (in this case, 8 seconds.)

A really good password tool which I use is SuperGenPass. It never stores your generated passwords but yet allows you to uses long and pseudo-random passwords without having to remember them.

It does this by taking the site's domain name (e.g. bleepingcomputer.com) and combining it with a master password that you select. This is then run through the MD5 hashing algorithm to produce a password up to 24 characters long. Additionally, every website will get its own unique password. The only shortcoming in my opinion is that it doesn't have a way to include special characters.

For example, on howsecureismypassword.net using the master password reallysecure gives skgBd8msOf7KAfJOUj9NDQAA as the password for that site:

Quote

And as long as I remember that my master password is "reallysecure" I can come back to that website and have my password only a click away.




PS.
1 Octillion is: 1,000,000,000,000,000,000,000,000,000

This post has been edited by Andrew: 31 July 2011 - 01:55 PM

Thank you for the reply and link Andrew. I'll surely use that site to set my passwords from now on. One thing that really shocked me - I thought I had a strong password for my online banking, but the checker showed it to be "crackable" in just 5 minutes!!!!!!!

I WILL be passing this information on.

Keith

Keith1, on 31 July 2011 - 10:06 AM, said:

Apparently this site does everything with Javascript on your machine, and doesn't send anything back to the main server.
The code is certainly there to do what it says it does. It also doesn't ask for any personal information such as an email address, so even if it were snatching back all the combinations you try they couldn't use that to break into anything. The one problem with the system is the assumption that the hacker is using a brute force. For example it tells me that a password "JosiahKIs#1" would take 53 thousand years to break. However since that name is published online and is based on my real name, I doubt it would take anywhere near that long.

My password will take about 800 trillion ska-skabillion years to crack. I'll give a hint...It's the name of a fish.

Holy crap, my password only takes 6 hours and my other password takes 0.4 seconds although it there are more then 8 characters

408 thousand years.. not too shabby haha.

for my password it says : About 423 million years not so bad,haha,thanks for sharing

600 years ...not so great but meh it'll do

The way I understand it, brute force hacking involves about 100 attempts/second. Banks and ATMs usually only allow 3-5 attempts before blocking for a few minutes or even permanently. This would increase the time astronomically.

It does depend on how fast you can check passwords. Even a badly written site that doesn't block on 3-5 guesses would take a lot longer to receive and check each attempt than trying to crack a password on a local machine.

Of course no 8 quieaxadzillion years is useful if someone sees you accidentally type the password in the username field.

4 Days... Hm... I either never need to piss off a hacker, or change my password. I think I'll do both

Rodax, on 29 August 2011 - 05:24 AM, said:

Lmao ^ good idea..

Wow, I thought my passwords were secure, guess I was wrong. Only takes a few days to hack them apparently