Reply-edit (original post was the first paragraph):
Length hardly matters. As long as a password is longer than about 15 letters, has at least 80 bits of entropy (basically, the randomness of the password), and is too random to be guessed by a human (a password like "chocolatebananakeyboard" is not, while something like "hsiCm5lax7" is), it's safe enough. "iwasonceatreehouseilivedinacakebutineversawthewaytheorangeslayedtherake" has 130 bits of entropy, which is more than sufficient, but it could be easily guessed by someone who only sees a part of the passphrase (like, say, "livedinacak"), and is a pain in the ass to type in.
"f6NzZ1o61OnYIwr4u9Ld", on the other hand, is almost 4 times shorter, has 108 bits of entropy, and is almost completely random. It uses both small and large letters and numbers, which makes the password much more secure than a password like "t85pt5xn3553ekreb3yf" (80 bits), although that's also sufficient if you find the capitalized letters way too hard to memorize.
And if you think "omg must use teh entire smp table for safety", WROOONG. "íCÙæÙzu<}¡Ýß" has 109 bits of entropy, which is only one bit more than in "f6NzZ1o61OnYIwr4u9Ld" (although that one is 5 symbols longer), but is ridiculously hard to memorize and incompatible with a lot of software and websites. Just add a special symbol like ")" or "&" somewhere in the middle of the password to make most brute force attacks unsuccessful, and you'll be fine.
A fairly simple password like "85ukd8u/0se2plz1", which has a length of 16 symbols, 86 bits of entropy, and only lowercase letters and numbers with a special symbol in the middle (vs. "85ukd8u0se2plz12" (75 bits)) would be random enough, easy to type in, pretty much impossible to guess and very hard to brute force in most cases. It would also be pretty easy to memorize with a bit of effort. Of course, you also have to be careful with
how you use the password. If you use it for all of your important stuff, you'll be screwed if someone finds it, which could be as simple as tricking you to "register" on a website.
Like I previously said, if you want to be safe, use multiple passwords like these, preferably one unique password for every site you register on, and use a password manager like KeePass to keep them all in a safe place. Oh, and don't put all of your eggs in one basket; make several backups of the database file. Put them on USB drives, put them on other computers, upload them to the Internet (the file is encrypted, silly). If you don't, and your HDD crashes or something similar, you're fucked.
Kasada wrote:
Still, this topic's purpose (Or my intended) was to see who had the longest password around here.
Sure, but some people here seem to think length is the only important factor, when it's really the least important one. I just felt like writing something educational for once.
I don't use it anymore, don't try.
