The numbers show why you should choose a complex password.

Although I already had a fairly good understanding of why you should choose a complex password when I first sat down and worked out the figures I was quite surprised at the margin between a good password and a bad one, so I thought it was worth sharing. This chart began life as a way to convince my non-techie friends that they should make their email and banking passwords slightly harder to guess than 'monkey'. It's worth noting that in a lot of cases a password taking interface will implement rate-limiting, which can mean that even simple passwords become almost impossible to guess. However we can't assume that this will always be the case and so choosing a proper password retains it's value.

Below is a table showing the approximate strengths and cracking times of a variety of simple passwords. Each password is constructed from a 'character set', each of which is easy to type with a standard US Keyboard. The cracking times are estimated using a baseline rate of 1000 password guesses per second which should be easily achievable using commodity hardware.

Note: Any password that uses dictionary words will be guessed even faster than listed below. This is because cracking programs will generally use a list of dictionary words and try them all before resorting to trying random combinations of characters. Given that there are (including scientific terms) approximately 1 Million words in the English language any password consisting solely of a single, lower-case, english word could be cracked in only 16 minutes!

  Character Set				No. of characters in set
  ________________________________________________________________
  Lowercase (L):					26	abcdefghijklmnopqrstuvwxyz
  Upper and Lowercase (UL):			52	ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
  Upper, Lower, Numerals (ULN):			62	ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
  Upper, Lower, Numerals, Symbols (ULNS): 	94	ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789~`!@#$%^&*()_-+={[]}:;"'<,>.?/|\


  Example password strengths:
  ___________________________
  Length: 5	Characters: L		Possible variations:	11881376	Time to crack:	3.3 	     hours	Example: abcde
  Length: 5	Characters: UL		Possible variations:	380204032	Time to crack:	105.6 	     hours	Example: AbCdE
  Length: 5	Characters: ULN		Possible variations:	916132832	Time to crack:	254.5 	     hours	Example: A12cd
  Length: 5	Characters: ULNS	Possible variations:	7339040224	Time to crack:	2,038.6      hours	Example: !A1cd
  Length: 7	Characters: ULN		Possible variations:	3521614606208	Time to crack:	978,226.2    hours	Example: 1AbCdE2
  Length: 7	Characters: ULNS	Possible variations:	64847759419264	Time to crack:	18,013,266.5 hours	Example: !cd1FE_