Hacker News Reader

It's not possible to look at a password and determine how long it would take to crack it, without knowing how it was generated. All you can say is how long it would take _you_ to crack it. But just because a password looks hard to YOU, doesn't mean it's not a dictionary word in Bulgarian or something. There's no way for you to know.

View on HN

It's also not possible to look at a password and determine long it would take to crack, even knowing how it was generated (to the reasonable extent I believe you implied, ie Bulgarian or English). Your password may happen to be the first word in a dictionary list or it could be the last word.

It is an inherently inaccurate probabilistic estimation of an attacker's methods, and does make any claim of being more than that.

If you know a password generation algorithm, you can compute a lower bound on the average time to crack a password given that it was generated by that algorithm. Some individual password might happen to get unlucky, but you can still have a good general idea of the strength of a password if you know the set it was drawn from and the distribution.

Reply on news.ycombinator.com