Using systems like TrueCrypt, when I have to define a new password I am often informed that using a short password is insecure and "very easy" to break by brute-force.

I always use passwords of 8 characters in length, which are not based on dictionary words, which consists of characters from the set A-Z, a-z, 0-9

I.e. I use password like sDvE98f1

How easy is it to crack such a password by brute-force? I.e. how fast.

I know it heavily depends on the hardware but maybe someone could give me an estimate how long it would take to do this on a dual core with 2GHZ or whatever to have a frame of reference for the hardware.

To briute-force attack such a password one needs not only to cycle through all combinations but also try to de-crypt with each guessed password which also needs some time.

Also, is there some software to brute-force hack truecrypt because I want to try to brute-force crack my own passsword to see how long it takes if it is really that "very easy".

  • 10
    Well now that you've told us your passwords are always 8 characters and not dictionary words, you've made it much easier ;-) – Josh Mar 13 '10 at 16:56
  • Damn! I should have better taken a dictionary word... :) – user31073 Mar 13 '10 at 17:13
  • If you are really concerned about passwords try KeePass. My password management had reached critical mass, then KeePass changed my life. Now I only have to remember 2 password, one to login to my computer and one to login to my KeePass database. All my passwords (and most of my usernames) are now unique and extremely complex, and using a username/password combo is as easy as CTRL + ALT + A if I'm logged into KeePass. – ubiquibacon Jul 12 '13 at 15:06

If the attacker can gain access to the password hash it is often very easy to brute force since it simply entails hashing passwords until the hashes match.

The hash "strength" is dependent on how the password is stored. A MD5 hash might take less time to generate then a SHA-512 hash.

Windows used to (and may still, I don't know) store passwords in a LM hash format, which uppercased the password and split it into two 7 character chunks which were then hashed. If you had a 15 character password it wouldn't matter because it only stored the first 14 characters, and it was easy to brute force because you weren't brute forcing a 14 character password, you were brute forcing two 7 character passwords.

If you feel the need, download a program such as John The Ripper or Cain & Abel (links withheld) and test it.

I recall being able to generate 200,000 hashes a second for an LM hash. Depending on how Truecrypt stores the hash, and if it can be retrieved from a locked volume, it could take more or less time.

Brute force attacks are often used when the attacker has a large number of hashes to go through. After running through a common dictionary they will often start weeding passwords out with common brute force attacks. Numbered passwords up to ten, extended alpha and numeric, alphanumeric and common symbols, alphanumeric and extended symbols. Depending on the goal of the attack it can lead with varying success rates. Attempting to compromise the security of one account in particular is often not the goal.

  • Thanks for this answer. I should have mentioned that I normally use RIPEMD-160 for the hash function. And for the password, with the way I generate it as described above that's 218340105584896 possible password (26+26+10)^8 (but the attacker does not know that). So I just wonder if such passwords are secure against brute-force attacks within reason (I'm not talking about keyloggers, cryotricks or rubber hose cryptography, only regarding brute-force password-guessing). And I am mostly using TrueCrypt. – user31073 Mar 13 '10 at 16:55
  • Just to clarify, you answered my question, based on 200,000 for 218340105584896 combinations on 1 node it would take ~36 years, provided that the attacker knows the password length. This is also what the online calculator gives me. Thanks! – user31073 Mar 13 '10 at 17:04
  • If it's possible for them to obtain the hash then yes it is possible to run a brute force attack. Whether or not they are successful depends a lot on how much they know about the password and how much time they have. Answer updated. – Josh K Mar 13 '10 at 17:07
  • 3
    Remember that 36 years gets quick if you precompute the hashes using a distributed network. If you use 1000 computers, then that's down to a manageable number. – Rich Bradshaw May 7 '10 at 6:04
  • 1
    It's also good to remind that by increasing the password length the difficulty increases immensely. If 8 char password takes 36 years, by doubling the length to 16 chars the time isn't doubled, but instead jumps up to 7663387620052652 years. :) – Ilari Kajaste Jul 22 '10 at 9:14

You can use this online tool for a estimation http://lastbit.com/pswcalc.asp

  • How accurate is that site? – Josh Mar 13 '10 at 17:00
  • 1
    @Josh; Looks like it just does the maths, so perfectly accurate given a correct passwords/second value. – Phoshi Mar 13 '10 at 17:02
  • Any idea why howsecureismypassword.net says it only takes 10 days to break this password? – sgmoore Jun 29 '11 at 9:43

EDIT: Others have given good answers for the part of your question regarding "How easy is it to crack such a password by brute-force? I.e. how fast"

To address this part of your question:

Also, is there some software to brute-force hack truecrypt because I want to try to brute-force crack my own passsword to see how long it takes if it is really that "very easy".

Here are a variety of options for bruteforcing Truecrypt

Here's another one from Princeton University.

  • This doesn't answer his question about how secure his short password is, and instead lays out various other attacks on the Truecrypt platform. – Josh K Mar 13 '10 at 17:11
  • @Josh K: No, it answers his question, "Also, is there some software to brute-force hack truecrypt because I want to try to brute-force crack my own passsword to see how long it takes if it is really that 'very easy'." – Josh Mar 13 '10 at 19:00
  • 1
    @Joshes now now, don't fight on each other! You're both actually the same person, aren't you? – cregox Mar 22 '10 at 17:50
  • No, actually we're not. – Josh K Mar 22 '10 at 18:31

The password:

This is a simple, but long, password.

is greatly more resistant to brute force, including dictionary based attacks, than:


So using a short but difficult password is just counter-productive. It's more difficult to remember and less secure.

Use a simple but long phrase.


GRC's haystack said it would take 36.99 minutes to crack your password in an offline attack. https://www.grc.com/haystack.htm

Not the answer you're looking for? Browse other questions tagged or ask your own question.