Password strength tester

What the textbooks say

The Grade 6 textbook says a password should be a mix of letters, numbers and symbols such as @ # $, should be at least 8 characters long, and should not hold simple information such as your name or your birthday, because those are easy to guess.

The Grade 7 textbook asks for a strong password that is hard to guess: at least eight characters, with small letters, capital letters, numbers and special characters. Its example is kanDY#4599.

The tool checks these as six rules, and ticks each one as your password meets it.

How a hacker guesses a password

A hacker does not sit and type. A computer does the guessing, millions of times faster than a person. It starts with lists: the passwords most people use, then names, dates and keyboard patterns. That is why password, 123456 and saman 123 fall in less than a second. Swapping letters for look-alike characters, as in P@ssw0rd, does not help, because the lists include those tricks too.

When the lists run out, the computer tries every possible password, one after another. This is called a brute-force attack. The only defence is to make the number of possible passwords too large to get through.

Why length and variety matter

Here is how long it takes to try every password of one kind, at 10 billion tries a second.

Using all four kinds of character gives each place in the password 94 choices instead of 26. Every extra character then multiplies the work by 94. That is why two more characters turn days into years.

Keep your password safe

• Use a different password for each website.
• Do not tell your password to anyone else.
• Log out when you leave a website, most of all on a shared computer.
• Do not use your own name as your username.
• Watch out for phishing: a fake page that asks for your password. A password that is handed over does not need to be guessed.

Is it safe to type my password here?

Yes. The checking is done by your own browser, and nothing you type is sent to this website or saved. Even so, here is a good habit: type a real password only on the page it belongs to. To test yours, type one that is built the same way.

About the estimate

The time is a rough guide, not a promise. It is for a computer that tries 10 billion passwords every second, which is possible once a hacker has stolen a website’s password file. A website that locks the account after a few wrong tries is far slower to attack.

The tool knows a few hundred common passwords, names and words. A real hacker has lists of millions, and may know things about you. The tool cannot know your name, your school or your pet’s name, so check for those yourself.

Key terms

Password

මුරපදය

Strong password

ප්‍රබල මුරපදය

Username

පරිශීලක නාමය

Hacking

අනවසර පිවිසුම

Small letters

සිම්පල් අකුරු

Capital letters

කැපිටල් අකුරු

Numbers

ඉලක්කම්

Special characters (symbols)

විශේෂ අක්ෂර

More to try

• Type saman. Then add one thing at a time: a capital letter, some numbers, a symbol, more letters. Which change adds the most time?
• Compare password with P@ssw0rd. Why is the second one no better?
• Type a name and a year, such as Nimali2011. What does the hacker spot?
• Make a password that would take more than 1,000 years to guess, and that you can still remember.

Passwords come up in the lessons on protecting the computer and using the internet safely. Practise with the Grade 6 and Grade 7 ICT past papers.