This is just a little exercise in partial differentiation
Introduction
So, you have a password of length from an alphabet
. Suppose you have a choice to increase the length,
, vs the alphabet size
. Which will make your password more secure?
In this sense we will assume that passwords are subject only to random guesses, and so we make the simple assumption that given the data , the larger the number of possible passwords, the more secure the password.
The set of passwords is . This has size
.
Simple Numerics
A simple approach is to simply make a table:

An eyeballing of this will tell you that most of time it appears that increasing the length is preferable to increasing the alphabet size. But then again, alphabet size jumps tend to be larger, e.g. 26 to 52, 52 to 62, etc.
Suppose you have a length password from the alphabet
. Are you better off going to length
, or going to the alphabet of size
, with the capital letters and the numebers? As it happens, it depends on
. For
, you should increase the length, but for
, you should double the size of the alphabet. This is typical.
Some analysis
Consider a password from a set of . Consider the two options, for constant
:
- increase the alphabet size:
, or
- increase the password length
.
If we look what these do to the number of passwords:
vs
,
we are comparing to
, and
are constant, we are comparing the exponential function
and the polynomial function
. While increasing the password length initially can do better, as
and particularly
increases, the exponential function speeds past the polynomial function, so eventually, it will make more sense to increase the alphabet size. Our eyeballing has let us down.
For example, from the table above, at and
, it doesn’t appear to be even close, here at
, and
, you get far more security increasing the length.
But for a fixed , there exists a length for which it makes more sense to increase the alphabet by a factor of
. The answer is 61.
So, if you have a length 61 password from an alphabet of size 20, you are better off increasing the alphabet size.
I guess what is relevant here are the following questions: at (adding the special characters), what are the answers?
- If
, and
, you could increase the length of the password rather than jumping to
.
- If
, and
, you could increase the length of the password rather than jumping to
.
- If
, and
, you could increase the length of the password rather than jumping to
.
Going to special characters only makes sense in our framework if there is also a password length condition of 10 or more.
Partial Differentiation
This wasn’t even what I wanted to do here, which was to approximate this question using partial differentiation. In all these questions we are asking about what happens to when we change
and keep
constant and vice versa. So partial differentiation. I guess the problem is
and
are discrete, rather than continuous, but sure
and
are perfectly good functions to differentiate. Let
.
Even I can differentiate with respect to (in fact, on first go I wrote with respect to
here, and got it wrong!):
.
We might use some logs to differentiate with respect to :
.
These partial derivatives estimate that if (a change of
and
,
,
so, approximately, we are left comparing and
. And here we see
vs
… eventually
if both grow, giving us the same answer as before.



Recent Comments