Passwords · By hand
I tried a hundred times: when to stop trying by hand
Trying by hand is fine and you should do it. What you shouldn’t do is try two hundred times, because past a certain point you are no longer searching: you are erasing the good clues from your memory by associating them with failure.
The practical limit
A focused person tries about fifty passwords in half an hour before they start mistyping. A computer tries, depending on the wallet, between hundreds and tens of thousands per second. The difference is not one of effort: it is one of magnitude. Everything you can do by hand, a machine does in its first second.
So your job is not to try: it is to remember. No machine can do that part, and it is where your case is decided.
The hidden cost of persisting
- You contaminate your memory. After fifty failures, your brain marks as «tried and wrong» things that may have been right but were mistyped.
- You stop writing things down. At first you note what you try; an hour in you don’t, and then you repeat yourself and lose track.
- You get tired and start discarding. That is when the good clue is lost.
- On some wallets, you burn real attempts. On hardware devices the number of attempts is limited and runs out. That part is irreversible.
When to stop, concretely
| Sign | What to do |
|---|---|
| You have been at it over an hour straight | Stop and rest |
| You no longer write down what you try | Stop: you are repeating yourself |
| You start trying things «just to try» | Stop: useful memory is exhausted |
| It is a hardware device | Stop immediately |
| Something new occurs to you | Write it down, don’t try it yet |
The productive thing from here is building the list methodically. It is explained in how to build a candidate password list.