Examining the Strength of Three Word Passwords

Fraser, William; Broadbent, Matthew; Pitropakis, Nikolaos; Chrysoulas, Christos

Abstract

Passwords make up the most common method of authentication. With ever increasing computing power, password complexity has had to keep pace. This creates a challenge for remembering all complex passwords which some password policies attempt to resolve. One such policy is to use three random words rather than a complex alphanumeric password. This paper attempted to prove the security of using such three-word passwords. It was discovered both theoretically and experimentally that three-word passwords should not be considered secure. Theoretical entropy of a three-word password found in the 25,000 most common words would be 43.8, that is lower than the entropy of a lowercase only password. Experimental data, collected via participant survey, shows up to 85% of random words provided by participants could be found in the top 15,000 common words found in the Google n-Gram data and 86.47% of combinations could be found in 25,000 most common words. This would mean, for at least 86.47% of cases, the entropy of the password is less than passwords already considered insecure in the industry.

Citation

Fraser, W., Broadbent, M., Pitropakis, N., & Chrysoulas, C. (2024, June). Examining the Strength of Three Word Passwords. Presented at ICT Systems Security and Privacy Protection (SEC 2024), Edinburgh

• Presentation Conference Type: Conference Paper (published)
• Conference Name: ICT Systems Security and Privacy Protection (SEC 2024)
• Start Date: Jun 12, 2024
• End Date: Jun 14, 2024
• Online Publication Date: Jul 26, 2024
• Publication Date: 2024
• Deposit Date: Aug 21, 2024
• Publicly Available Date: Jul 27, 2025
• Publisher: Springer
• Peer Reviewed: Peer Reviewed
• Pages: 119-133
• Series Title: IFIP Advances in Information and Communication Technology
• Series ISSN: 1868-4238
• Book Title: ICT Systems Security and Privacy Protection 39th IFIP International Conference
• ISBN: 978-3-031-65174-8
• DOI: https://doi.org/10.1007/978-3-031-65175-5_9
• Keywords: Authentication, Password, Entropy, Google n-Gram