We have used passwords to prove our identity since the first computers shared among multiple users.
Decades later, they are still there, and still causing problems. Their bad reputation is not really deserved, however. Most of the risk comes from human limitations and our predictable behaviors, rather than the mathematical probabilities of having to guess every possible combination.
On the occasion of World Password Day, let’s return to an often underestimated paradox: why can passwords considered “strong” turn out to be more vulnerable than they appear? What do the most seasoned attackers actually do, and how do you create passwords that are truly difficult to crack?
We readily believe that a password of 10 characters mixing lowercase, uppercase, numbers and special characters generates an astronomical number of possible combinations, and that it is therefore necessarily secure. Indeed, the total search space is around tens of quintillion combinations (around 5.4×10¹⁹). Even testing a billion attempts per second, an attacker would need around 1,700 years to exhaust the entire space through pure brute force.
On paper, that’s reassuring. In practice, this is misleading, because very few people choose truly random 10-character passwords. To remember this, we instinctively fall back on predictable patterns: an uppercase letter at the beginning, one or more lowercase letters, then 1 to 4 digits (often a year), and a special character at the end of the string.
Seasoned cybercriminals know this: They don’t try to test every possible combination; they attack your habits. By limiting ourselves to “human” type diagrams, the field of possibilities is reduced to approximately 10¹⁴ combinations (100 trillion). With a high-end GPU capable of testing 100 billion attempts per second, this volume runs out in minutes, not centuries.
From a purely mathematical point of view, a truly random 15-character password is virtually impossible to crack with today’s equipment. If the password is random, the numbers work in your favor. But we always come back to the same problem: humans.
When people create long passwords, they rarely opt for random strings. They reuse known patterns, make slight variations on old passwords, and generally prefer easy-to-remember phrases rather than truly random strings. Attackers take advantage of this by cross-referencing these habits with huge password dictionaries from data leaks, to which they apply transformation rules, such as adding the current year, replacing letters with symbols or adding punctuation, to quickly guess these “memorable” passwords.
They also build rainbow tables: precomputed tables of password hashes. Most systems do not store passwords in plaintext, only their encrypted hash. A rainbow table allows an attacker to go back from a hash to the original password, provided that the latter appears in the table, which is often the case, these tables being freely downloadable online. If your 15-character password is there, or if it’s a predictable variation, the length won’t protect you. It will fall in seconds.
Are passwords still useful today?
Yes, but they are no longer enough on their own. Multi-factor authentication (MFA) should be enabled wherever possible, as it makes stolen or guessed passwords much less exploitable.
If you continue to use passwords, the best approach is simple: stop letting humans design them. Use a password manager to generate and store long, truly random passwords (20 characters minimum), without ever reusing them. Enable MFA wherever possible. And for the rare passwords that you must memorize, rely on long and unique passphrases, composed of random words, not song lyrics, quotes or other memorizable patterns. The objective is not perfection: it is to make the attack sufficiently difficult and unprofitable for the attackers to look elsewhere.
