Passwords · Long phrases
My password was a long phrase: better or worse for recovery?
There is an idea that a long password is impossible to recover. It isn’t true, and the reason is interesting: what makes a password hard is not its length but how much of it can’t be guessed. And a phrase you chose is, by definition, something that occurred to you.
Length is not the same as randomness
«correct horse battery staple» is twenty-eight characters and enormously secure against someone who doesn’t know you. But if you remember it was a four-word phrase, and you remember two of the words, or what they were about, we are no longer facing thirty random characters: we are facing a few combinations of words.
The reverse is also true: an eight-character randomly generated password is far harder to recover than a forty-character phrase you composed. Length is misleading.
What makes a long phrase recoverable
- Remembering how many words it had.
- Remembering the theme, language or origin: a song lyric, a line of verse, a quotation, a family saying.
- Remembering how you separated the words: spaces, hyphens, initial capitals, all run together.
- Remembering whether it ended with numbers or punctuation.
When a long phrase really is unrecoverable
When the words were chosen at random by a program and mean nothing to you. That is the case with phrases generated by managers or «secure passphrase» tools: they are long, they are memorable in theory, and if you don’t remember them there is nothing to rebuild, because there is no logic of yours behind them.
The line, then, is not length: it is whether the phrase came out of your head or out of a generator. The same point I make in my password was generated by a manager.