Accessbox · Security
Why this password is easy to guess
Accessbox flagged this password because it's built from ordinary dictionary words. It still works, and nothing has been changed. But if a site that stores it is ever breached, a password like this can be cracked far faster than it looks. Here's why, and what to do about it.
Does my password still work?
Yes. Accessbox hasn't changed anything, and this doesn't mean your account was hacked. The warning is about how the password is built, not about something that happened to it.
What's the actual risk?
Not someone guessing at the login screen. Sites block that after a few wrong tries.
The risk is a breach. Most sites don't store your password itself. They store a scrambled version that can't be turned back into the original. When a site is hacked, attackers can take a copy of those scrambled passwords and try to crack them on their own computers. They guess a password, scramble it the same way, and check for a match. There's no lockout, no limit, and nobody watching. They can make billions of guesses, and they start with the most likely ones, such as everyday words.
A password that's hard to guess makes each of those guesses count for less.
Why are words easy to guess?
Attackers don't guess one letter at a time. They guess whole words, then pairs of words, then those same words with numbers and symbols swapped in.
A password built from everyday words can look long. To an attacker, it's just a few picks from a dictionary. Swapping letters for symbols, like 3 for e or 0 for o, doesn't help much. Attackers try those swaps too.
Words themselves aren't the problem. Accessbox uses words too, but it picks them at random from a large list, not the ones that come to mind. People tend to choose familiar words in familiar orders, and that's exactly what attackers try first. With random picks, an attacker has to try every combination, and Accessbox can count exactly how many there are.
How long would it take?
Every random character multiplies the number of possible passwords by 94, one for each letter, number, and symbol an attacker has to try. That's why a few extra characters make such a big difference.
How fast attackers can guess depends on how carefully the site scrambled its passwords. You won't know which kind of site you're dealing with until it's breached, so it's safest to assume the worst.
| As hard to guess as | Careless site | Careful site |
|---|---|---|
| 4 random characters | Instantly | About 2 hours |
| 5 random characters | Instantly | About a week |
| 6 random characters | Seconds | About 2 years |
| 8 random characters | Hours | Thousands of years |
| 10 random characters | About 17 years | Millions of years |
| 12 random characters | Over 100,000 years | Longer than the universe has existed |
These are the times to try every possible password. On average, attackers find it in about half that time.
If there's no warning, does that mean a password is safe?
Not necessarily. Accessbox can spot some of the shortcuts an attacker would use. When it finds one, it tells you. When it doesn't, that isn't a promise the password is strong. It only means Accessbox didn't find an easy way in.
What should I do?
Open the card and tap Password Update Assistant to change the password on the site, or tap Generate new password to have Accessbox create one.
If you typed this password yourself, turn off Keep password as typed first so Accessbox can create a new one for you.
What if the site won't let me change it?
That's okay. Some sites make it hard to change a password. The most important thing is to not use this password anywhere else. Some sites store passwords carelessly, and when one of those is breached, no password is strong enough. When each site has its own password, a breach on one site can't unlock your other accounts.