Password Evaluator
Pwcheck.pl Instructions

Overview

Password Evaluator is designed to examine passwords and tentative passwords to look for dictionary words and patterns that a password cracking tool might exploit. It looks for reversed, rotated, keyboard shifted, truncated, dropped letters, substituted characters and other variations on dictionary words both singly and in many combinations. It looks for too many of a single character, keyboard and ASCII sequences, a character repeated too many times without different intervening characters and character patterns that repeat. It looks for phone numbers, dates and social security numbers.

The intent is to find any password that could be found in a dictionary or electronic word list, as well as any plausible programmatic variation of such words, including combinations of two or more words, and combinations of words with patterns that might be generated from character arrays representing the ASCII collating sequence or the keys on a standard keyboard.

The default settings are aggressive in that they attempt to identify passwords to which more transformations have been applied than any contemporary password cracking tool is known to do. It's our belief that for the foreseeable future, brute force cracking of well constructed passwords of sufficient length and character type diversity is not feasible, and for all intents and purposes, a waste of CPU cycles. Any pattern that can be described, or any word that can be varied in a manner that can be described, and any combination of these, are more likely to produce passwords in actual use than a brute force method. Thus, password cracking tools are likely to acquire the capabilities to manufacture large subsets of what have traditionally been thought of as good passwords.

Password evaluator in a CGI form is purely advisory. Users are free to disregard errors as well as warnings, though password evaluator will not display length and strength for any password with one or more "error" conditions. If a user believes the minimum password requirements are too stringent, there are numerous configuration options that will allow them to be relaxed. Shortening the minumum password length, lengthening the minimum or maximum dictionary word lengths, increasing the maximum word length ratio, increasing the allowed number of any maximum character or pattern type, not checking for specific password types, and not checking for words across non letters, will all loosen conditions that generate errors.

With default settings, a password that gets no errors should not be easily cracked with today's cracking tools using default rules and an unabridged dictionary available on line. Password evaluator includes a significant list of common names as well as lists of common passwords. It does not include words drawn from lists related to popular culture or other specialty areas. Thus it will likely miss passwords based on sports, contemporary musical groups and movies, slang, brand names, and other terms in common use today, but not readily available in existing online word lists.

Loosening the conditions that cause errors to be reported will not affect the strength calculation. This is based on password length and character diversity.

A 0 strength password presents no significant challenge to brute force methods. A password with a 1 strength rating may be broken by brute force if the cracker is moderately determined. These descriptions are intentionally vague. The strength ratings are intended solely as relative strength ratings and the decision where to draw the line between 0 and 1 is arbitrary. From 1 and higher, the dividing line for each increase represents a ten times greater resistance to brute force attacks than the preceding. There are no fractional ratings so there is no 1.99 or 2.01. A 3 is more than 10 times stronger than a 1 and less than 1000 times stronger; on average a 3 should be about 100 times stronger than a 1. This arbitrary scale seems appropriate, as the number of CPU cycles necessary to crack a password with brute force jumps significantly with each additional character and each additional character type.

Check Passwords for Windows NT / 2000

Passwords intended for use on Windows NT or 2000 must be checked with the check passwords for Windows NT / 2000 enabled. Checking passwords for Windows systems without checking this option will give totally misleading results. Read about how Windows NT and 2000 store password hashes to understand why.

Because of the unusual way in which Windows NT and 2000 store password hashes, most of the usual recommendations for forming good passwords don't apply. If this option is checked, Password Evaluator, will adjust to Windows password peculiarities. First the password is split into two 7 character pieces which are checked separately. Case is ignored and maximum dictionary word length is set to 2.

With 7 character passwords, even a three character word at the begining of a password will greatly simplify L0phtCrack's task. L0phtCrack is the most widely used password cracker on NT. Begining an NT password with a three character word, effectively reduces the problem to a 4 character brute force attack which L0pthCrack will handle easily.

The highest possible NT password strength is 4 and this will include at least one character typed while holding the ALT key while pressing three digits on the numeric keypad with Num Lock on. It will also include two symbols or punctuation from different parts of the keyboard and a consonant, vowel, and digit. NOTE: Entering non typable characters with the ALT key will create passwords that are not crackable and much stronger than the listed strength. Because no cracking tool uses these characters, and there are so many of them, these passwords will never be cracked unless the cracking tools and assumptions are changed.

The total strength of an NT password will be the strength of the stronger piece. For most purposes the other piece can be ignored; it's not needed and does not matter even it contains errors. Two pieces rated 4 will be somewhat stronger than one piece but this is not especially significant on an exponential scale.

Minumum Password Length

Sets the minumum number of characters allowed in a password. Any password less than this length will generate an error message.

Minumum Dictionary Word Length

Sets the minimum number of characters that Password Evaluator treats as a word. When checking pure alphabetic passwords, it may be advantageous to set this to 4. As password evaluator treats any character sequence that is not fully contained within another as a word, including reversed words, any pronounceable letter sequence has a good chance of containing multiple words though there may not be any practical programmatic way to put these together. For example, "quirehc" contains quire and reversed che. The longer a pronounceable alphabetic sequence becomes, the more likely there will be multiple words contained within it. It's also less likely there will be an easy and general description of the method by which the password was created. Without this, the cracking tools cannot program a method for creating such a password.

Raising the minumum word length to 4 significantly reduces the number of run together and overlapping words in long alpha only sequences. In general it is a bad idea to increase the minimum over three as this prevents Password Evaluator from catching fairly obvious passwords such as "dog8cat". Not only is it "clever" but it consists of two short, very common words, separated by a non letter. This may be the simplest and most productive custom dictionary to program after the standard dictionary transformations.

Maximum Dictionary Word Length

Sets an upper length limit on the longest dictionary word allowed in any password. Any dictionary word that is longer than this length, after non letters have bee removed, will trigger an error. If the word is truncated, the length of the word after it is completed to match a dictionary word is used Generally the maximum word length ratio is more important but for long passwords, this can prevent any long word from being used.

Maximum Dictionary Words

Limits the maximum number of dictionary words allowed in a password. The default is 1 and probably should not be changed. The allowed word or words must be no longer than the maximum dictionary word length or the maximum length compared to the maximum dictionary word ratio. This allows dictionary words or transformations of them that are a limited part of a password. It's very hard to create long pronounceable alphabetic sequences without getting any short words or any possible variation of a word in them.

Setting this to 0 will prevent any word or identified transformation of a word from being accepted in any password. A word is any character sequence equal to or longer than the minimum dictionary word length that appears in the dictionary used for checking. Straight lookups and reversed word lookups are always performed. Some of the tests cannot be performed or make no sense on short character strings so the Password Evaluator contains some hard coded lower limits related to word length.

Setting maximum dictionary words to 2 or higher will prevent Password Evaluator from finding relatively obvious passwords like "cat8rat" which it was expressly designed for. In the future a range option may be added so that multi word phrases will be accepted but simpler passwords rejected.

Maximum Word Length Ratio

Maximum word length ratio may be the most important single setting after minumum password length. The default is .66. This results in the rejection of any password where a dictionary word or variation on a dictionary word is two thirds or more of the total length. The setting .67 is much weaker. The default .66 limits 6 character passwords to one three letter word, 7 character passwords to a four letter word and 8 and 9 character passwords to five character words. Six, seven and eight character passwords must have at least three characters that are not part of a dictionary word. Nine character passwords need at least four non word characters. .66 will allow cat824 or batxzt but not boat11. .67 would allow boat11. There is no question that cat824 is a weak password but that is reflected by its 0 strength rating.

Having to find three non word characters adds a significant computational overhead. If only letters are being examined the work load is increased by a factor of 17,565. If all 95 printable characters are being checked, the factor is 857,375. Depending on assumptions regarding character sets and word lengths used "cat824" is somewhat to many times stronger than "cat8rat". "cat8rat" is very much at the easy end of passwords made from two short words separated by a non letter based both on word frequency and password length.

If the intent is to use only strong passwords, then the minimum length should probably be set to 8 and only passwords rated around 3 or higher considered.

Maximum Character Occurrences

Sets an upper limit on how many times a single character can appear in a password. If the number is 1 or more it's treated as a count of how many times any single character may appear in a password. If it's less than 1, then the character cannot comprise a larger portion of the password than the value. The default is .4 which allows any single character to be up to but no more than 40% of the characters in a password. This is 2 in a six character password, 3 in seven, eight and nine character passwords and 4 in ten, eleven and twelve character passwords.

Maximum Sequence Characters

Sets an upper limit on how many characters from the ASCII collating series (letters, numbers, etc. where numbers precede letters and upper case letters come before lower case) or keyboard sequences. The default is 2. Sequences are in either direction so "345" is a sequence as is "dcb" both of which would be disallowed by the default. Keyboard sequences are physical keys regardless of shift state so "6&8" is a sequence as is ">,M" and "*&6". The maximum sequence characters also applies to alternate character sequences so that "*j1a2c3K?" would be disallowed as would "1b^o5a$T!" ("^5$" is a reverse alternate character keyboard sequence). Increasing this to 3 would not be unreasonable. Because of the many combinations of ASCII and keyboard sequences, reducing this to 1 is probably not practical.

Maximum Repeat Characters

Sets an upper limit as to how many times the same character may repeat without a different intervening character. The default is 2 so that "aaa" or "333" would not be allowed in any password. A 1 disallows repeated characters. A 0 has the effect of disabling repeat checking.

Maximum 2 Character Pattern Repeats

Sets an upper limit on how many times the same two consecutive characters can appear in a password; this applies to any and all characters regardless of where they appear in the ASCII collating sequence or the keyboard. The default is 2. "d*aP@d*1?" would be allowed but not "d*Ad*@1d*?".

Do Not Allow All Digits

If checked, disallows passwords consisting solely of numbers. There are less digits than any other character type making the number of passwords particularly small if all digit passwords are allowed. The only character type that might be considered smaller than numbers is single case vowels but usually all 26 of the same case letter are treated as a group. The default is to not allow all digit passwords.

Maximum Digit Ratio for Full Strength Estimate

The standard strength calculation is a function of how long the password is and the diversity of character types. If the number of digits in a password exceed the ratio specified by maximum digit ratio for full strength estimate, the strength calculation may be adjusted downward. The default is .7. The reasoning is that if any standard numeric format is used, the separators are mostly noise and contribute nothing to the strength of the password. If the password contains any letters, the normal strength calculation is used as no know standard numeric formats contain letters.

If the password digit ratio exceeds the maximum and contains no letters but does contain any of the common numeric separators, "/", "-", "(" or ")", then only the digits are used in calculating the password strength. This pretty much means the password strength will be zero as it takes 13 digits to get a strength of 1. The presence of the these characters, mostly digits and no letters is very suggestive of a standard numeric format such as "(222) 333-4444" for a phone number. This pattern is 14 characters long but all likely variations can be gotten just by changing the 10 digits. Further only about a quarter of the area codes are assigned. Finally, using just local area codes (for the target computer) is likely to be much more productive than using all valid area codes.

Keep in mind, the goal of the cracker is to maximize the use of available CPU cycles by trying potential passwords that have a significantly better chance of being used than any random character sequence that might be generated. So the cracker can likely improve efficiency further by using only assigned local exchanges. Local phone numbers might not produce a single password but they have a much better chance than any comparable length random sequence, regardless of whether you count 10 or 14 characters. Local phone number are much more likely to be used than any possible long distance phone number. Standard phone number formatting, (222) 333-4444 or 222-333-4444, is more likely to be used than non standard, e.g. 222x333*4444.

If the password digit ratio exceeds the maximum and contains neither letters or any of the common numeric separators, the strength is reduced by 1 from what it would otherwise be.

Maximum Vowels Only and Maximum Consonants Only

One common way to form passwords is to drop the consonants or especially the vowels from a word, e.g. psswrd. The maximum vowels only and maximum consonants only checks prevent this with a very low CPU and IO overhead. The default settings are both 2. Limiting the kinds of character variation in a password is not good so it's useful to disallow consonant or vowel heavy passwords even if they are not derived from dictionary words. These should not be decreased as that would discourage the use of a few letters in a password with many digits, symbols or punctuation. Setting these to three should have no adverse consequences. Setting these higher will start to allow modified dictionary words that form a significant part of the password.

Do Not Allow Dates, Phone or Social Security Numbers

By default all of these are checked and prevent passwords that consist entirely or almost entirely of dates, phone numbers or social security numbers. Common formats and obvious variations are checked. Only passwords that consist entirely of these or these plus white space are rejected. Even obvious dates, phone numbers and social security numbers are allowed if the password contains other non white space characters.

Check Words Across Non Letters

When check words across non letters is checked, the default, Password Evaluator will remove all non alpha characters and check the remaining letter only strings to see if they are words or contain words. If this is not checked, only contiguous sequences of letters are checked for words.

Additional Minimum Word Length

Additional Minimum Word Length when checking words across non letters adds the length specified here to the minimum dictionary word length to determine what to count as a word and what not. The intention is to find dictionary words that have been hidden by inserting non letters between two or more letters. It is not to find small words that happen to get created when separate letter sequences that are not words and not contiguous are put together. Increasing the minumum length by 2, the default, greatly reduces the number of created words that may occur while still catching small separate words that have been combined with non letters.

Unchecking check words across non letters will allow passwords like ta2b4l6e. Using all three through nine character words from the 45,000 Linux word list combined with every possible two through 5 character even and odd and even and odd reversed digit sequence to create every possible password up to 11 characters results in only slightly over 6 million passwords. This is a tiny custom dictionary compared to others that have been discussed. Though there are obviously an enormous number of ways to break up words with non letters, the human tendency is to take the easy way. Checking words across non letters is the only practical way to eliminate the simple ways. No password made from a dictionary word variation is good, even if it's not obviously bad, and they should not be allowed.

Maximum Suffix Word Length Ratio

If the length of a dictionary word plus an "ed" or "ing" suffix is equal to or greater than the maximum suffix word length ratio, the suffix length is counted as part of the word length. Normally only the part of the word that is the dictionary word is counted. Without this, a non word could be made by appending "ing" to a short word that does not have such a suffix. Only the short word length would count and thus likely be less than the maximum dictionary word length or ratio. For example, unless the "ing" in "adaming" which is not a dictionary word, is counted as part of the word length, "adaming" will be accepted as a password even though it is one of the most trivial dictionary word variations and one which the cracking tools easily exploit.

With the default setting of .75, at least three characters that do not create a new word must be prepended or mixed into the first part of "adaming" for it to be accepted. Raising this to .8 allows only two additional characters to make an acceptable password. If you care about strong passwords and presumably you would not be using Password Evaluator unless you do, it's best not to raise this. Values entered here less than the maximum word length ratio will have no effect.

Top of Page - Site Map

This page is not covered by the GeodSoft Publication License. Copyright © 2000 - 2006 George Shaffer. All rights reserved.