$^$^$^_ = crack time 26 days
$^$^$^i = crack time 3 months
$^$^$^z = crack time 5 years
Should the result vary so widely given the arguably minor variation?
$^$^$^i = crack time 3 months
$^$^$^z = crack time 5 years
Should the result vary so widely given the arguably minor variation?
n log (c)
for a length-n password with symbol space c. the huge difference in crack time is because zxcvbn is using c==33 (symbols only) for $^$^$^_ and c==59 (symbols + a-z) for $^$^$^z
$^$^$^i is in the middle -- 'i' is considered a dictionary match, the rest is c==59 bruteforce.
the bigger problem is $^$^$^ isn't recognized as a pattern, but i'm working on ways to improve bruteforce estimation too. good example!
notaword12 - 17 hours
notawrod123 - 22 minutes
With almost any not-word, really. The extra 12 is better than 123 somehow.