An 8-character password is searched for by brute force, trying every candidate. If 1×10^10 candidates can be tried per second, which combination is closest to the time needed to try all candidates for a password made only of lowercase letters (26 kinds) and one made of uppercase letters, lowercase letters and digits (62 kinds)?

Answer: A. Lowercase only: about 21 seconds; 62 kinds: about 6 hours

The number of candidates for an 8-character password is the number of usable characters multiplied by itself 8 times. With lowercase letters only it is 26^8 = 208827064576 (about 2.1×10^11), so at 1×10^10 per second all of them are tried in about 2.1×10^11 ÷ 1×10^10 ≈ 21 seconds. With 62 kinds it is 62^8 = 218340105584896 (about 2.2×10^14), which takes about 21834 seconds, or about 6 hours. Increasing the kinds of characters multiplies the number of candidates by the per-character ratio raised to the 8th power, so here it grows about 1000 times. This calculation, however, is only a guide for brute-forcing leaked fast hashes offline. Dictionary words and reused passwords are found far sooner than by brute force, so it is important to use long, random passwords and, on the service side, to combine slow hashing, limits on login attempts and multi-factor authentication.

• A. Correct. 26^8 ≈ 2.1×10^11 takes about 21 seconds, and 62^8 ≈ 2.2×10^14 takes about 21834 seconds (about 6 hours).
• B. About 4.7 minutes is the value obtained by mistaking the set for the 36 kinds of lowercase letters and digits (36^8 ≈ 2.8×10^12, about 282 seconds).
• C. These values come from mistaking the guess rate by one digit, as 1×10^9 per second (about 209 seconds and about 218340 seconds).