Harder or Barely? — TechKnowSurge

About this interactive

What you are doing: deciding whether a change to a password makes a brute force attack much harder, or barely moves it. A brute force attack works through combinations in order until one fits. Each character you add to the length multiplies the number of combinations, so the time climbs steeply: the lesson measured about a second for one character, nineteen seconds for two, and eighteen minutes for three. Adding length is what hardens a password, which is why the guidance is a dozen to sixteen characters. A cosmetic tweak to a short password barely helps. Swapping one letter for a lookalike symbol, capitalizing a letter, or reordering the characters adds no length, and the brute force already tries every character type in each position, so the number of combinations stays the same. Judge the change by how much it grows the search, not by how clever it looks.

What you'll learn

Judge whether each described change to a password makes a brute force attack much harder or barely changes it

Aligned to

CompTIA Security+

2.4 Given a scenario, analyze indicators of malicious activity.

Key terms

Brute Force Attack: An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Password Complexity: A security requirement that mandates passwords include a mix of character types such as uppercase letters, numbers, and symbols to reduce the risk of compromise.

Topics

Brute Force Attack Password Complexity Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →