Passwords are often the most vulnerable points of our internet security.

This is largely because login information requires the most user responsibility.

Often, sites and services will have strict requirements about password length and

character minimums.

This is a good example of the trade off between security and convenience, these

requirements do you in fact translate to additional effort for attackers.

So it is in your best interest to have stong passwords.

But a lot is demanded of us to generate and memorize complex passwords.

So much so that we may take shortcuts that eventually cost us.

We'll explore password strengths and weaknesses over two videos.

This first video will address some of the risks associated with

less than optimal passwords.

Let's first take a look at just how much the length of a password can

affect its strength.

Let's consider a PIN, for example, one used for your ATM card or

to unlock your phone.

There are ten possibilities for each digit used, zero through nine.

If your PIN was only one digit, the total number of possible PINs would be ten.

Let's make it a two digit PIN 10 x 10 = 100.

Now there are 100 possible combinations, and your PIN just got ten times stronger.

Typical PINs are four digits long, 10 x 10 x 10 x 10, 10,000.

There are 10,000 possible four digit PINs.

So what happens if you could add a lowercase letter,

any of the 26 letters available in the English alphabet at the end of your PIN?

10 x 10 x 10 x 10 times 26,

260,000, now we're talking.

260,000 different possibilities may seem like it would be more than adequate.

This would definitely be overwhelming for a human to try.

And typically, there are safeguards in place for multiple failed attempts anyway.

But nowadays, computers can try all the possibilities much faster than a person.

260,000 different PINs would fly by in the blink of an eye.

And not every service will have those same failed attempt safeguards.

Your best chance of security is to strengthen those passwords beyond a doubt.

This table is a logical extension of the previous exercise.

It shows how long it would take a modern computer to try

every possible valid input for the given constraints.

This is a bit of a simplification, and conditions would be

different if this was say a government agency with unlimited resources.

Compared to just a single laptop trying to break a password.

But it does serve a purpose.

Notice that increasing the number of characters extending the length

of a password has a much greater effect on its strength

than allowing additional possible characters.

While increasing both has a considerable compound effect.

This is great to keep in mind for when you're creating your own passwords.

The previous table showed how long it would take a modern computer to try every

possible password of a certain length and set of characters.

But password cracking, where attempts to guess or

force through password protection, is often smarter than that.

A password cracking tool may try the top 100 or

even top 10,000 most popular passwords first.

There's a very good chance it could save a lot of time.

If those failed, it could then default back to trying every possibility or

brute-forcing it.

Note the password, 0123456789, this is a 10-character password.

By our previous table, assuming all characters are valid,

this would take a brute force approach over 900 years for a modern computer.

But cracking tools would have this password broken in an instant.

The same is true for using a single dictionary word.

Tools will often consult prioritized lists of possibilities.

We've seen how length and available characters can affect password strength.

So now we want to make our own password plenty long, maybe 20 characters.

And we've learned how cracking tools are often smarter than a brute force approach,

by prioritizing common passwords and dictionary words.

So we'll make our 20 character password a randomized bunch of letters, numbers and

symbols.

We'll want to memorize this so we can use it whenever we need.

Having one extra strong password should be enough for all of our accounts, right?

Well, unfortunately as we learned in our very first video,

that services have breaches and personal passwords get leaked.

We'll want to have unique passwords for each service we use.

So to recap, passwords must be long, be unique, have never been used,

contain no personal info, and contain no dictionary words.

And we're also expected to memorize each one of them?

It's no wonder that some people sacrifice their password strength for some sanity.

Well, in the next video, we'll explore some tools that can offer some super

easy solutions without sacrificing much security at all.