What will you find here?
Three focused reports: how password length changes the number of possible passwords, how long those passwords could take to guess under different scenarios, and how random EFF passphrases compare. These are calculated examples, not results from real attacks.
Which password statistics are available?
Password cracking time
Compare exhaustive and expected search durations under three explicitly assumed rates.
Open report → Computed modelLength vs. complexity
See the minimum uniformly random length needed to reach modeled entropy targets.
Open report → Computed + censusPassphrase security
Review EFF long-list combinations, entropy, and complete word-length statistics.
Open report →Can you download the data?
Yes. Download the complete JSON file or choose a smaller CSV for the report you need. Each file includes the exact values used on these pages.
How can you check the numbers?
The release file lists every alphabet, password length, target, guessing speed, and word count we used. Run npm run research:generate to rebuild the pages and data, then npm run check:research to confirm that your copy matches ours.
Whole-number totals are kept exact. Time estimates are kept as exact fractions of a second. Entropy estimates use Math.log2 and are rounded to six decimal places.
The source files, schema, instructions, and rights notes are all committed under research/. The release contains no user passwords or generated password samples.
Where does the data come from?
- NIST SP 800-63B-4, Appendix A: Strength of Passwords — explains why a mathematical password model is different from a password someone chooses, and why online and offline attacks behave differently.
- EFF Long Wordlist for Passphrases — the 7,776-word list used in the passphrase report.
- Release 1 data and calculation details — the alphabets, lengths, targets, guessing speeds, formulas, and source notes behind the reports.
NIST and EFF provide the background and source list. We calculated the tables, charts, password totals, entropy estimates, time estimates, and word-length figures shown in these reports.
How do we handle updates and corrections?
We review the release at least once a year and update it sooner when a source or calculation changes. Report an error through the publisher contact form; if a number changes, we regenerate the data and record the correction here.
Generate My Password, published by United Internet Ventures LLC, owns this release. Cite the report title, URL, release ID password-statistics-release-1-v1, and access date.
2026-10-21 — Initial research release.