You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Previous episode Password hashing algorithms: how a website fights a very fast password cracker

How passwords and logins work: why a website should not know your password

Password strength: what really makes a password hard to guess

A password with a capital letter, a digit and a symbol looks hard to guess. Yet many of these passwords are among the first guesses of a password cracker. A strong password needs something other than what the sign-up form asks for.

  1. 1 You choose a new password. The gym's form asks for a capital letter, a digit and a symbol, so you type Sunflower7! with a smile. It looks much harder than before.youclimbwall.exampleNew passwordSunflower7!a capital lettera digita symbol

    You choose a new password. The gym's form asks for a capital letter, a digit and a symbol, so you type Sunflower7! with a smile. It looks much harder than before.

  2. 2 Rono's program does not try passwords in alphabetical order. It starts with what people really pick, and goes down from there.Rono's guess list123456passwordqwertytried first

    Rono's program does not try passwords in alphabetical order. It starts with what people really pick, and goes down from there.

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode Credential stuffing: why a leak at one website is a danger for your other accounts

Share this comic

More comics