The DOI matches its Crossref record; 14 of the 14 references it cites were found in a registry or an index.
Password Strength: An Empirical Analysis
Abstract
It is a well known fact that user-chosen passwords are somewhat predictable: by using tools such as dictionaries or probabilistic models, attackers and password recovery tools can drastically reduce the number of attempts needed to guess a password. Quite surprisingly, however, existing literature does not provide a satisfying answer to the following question: given a number of guesses, what is the probability that a state-of-the-art attacker will be able to break a password? To answer the former question, we compare and evaluate the effectiveness of currently known attacks using various datasets of known passwords. We find that a "diminishing returns" principle applies: in the absence of an enforced password strength policy, weak passwords are common; on the other hand, as the attack goes on, the probability that a guess will succeed decreases by orders of magnitude. Even extremely powerful attackers won't be able to guess a substantial percentage of the passwords. The result of this work will help in evaluating the security of authentication means based on user- chosen passwords, and our methodology for estimating password strength can be used as a basis for creating more effective proactive password checkers for users and security auditing tools for administrators.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Adams, A., & Sasse, M. A. (1999) · Communications of the ACM · doi:10.1145/322796.322806 · Cited by 1,401
A large-scale study of web password habits
Florencio, D., & Herley, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242661 · Cited by 1,047
Password security: a case history
Morris, R., & Thompson, K. (1979) · Communications of the ACM · doi:10.1145/359168.359172 · Cited by 926
Telling humans and computers apart automatically
von Ahn, L., Blum, M., & Langford, J. (2004) · Communications of the ACM · doi:10.1145/966389.966390 · Cited by 895
Password Cracking Using Probabilistic Context-Free Grammars
Weir, M., Aggarwal, S., Medeiros, B. D., & Glodek, B. (2009) · 2009 30th IEEE Symposium on Security and Privacy · doi:10.1109/sp.2009.8 · Cited by 524
Making a Faster Cryptanalytic Time-Memory Trade-Off
Oechslin, P. (2003) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-45146-4_36 · Cited by 494
Fast dictionary attacks on passwords using time-space tradeoff
Narayanan, A., & Shmatikov, V. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102168 · Cited by 447
Foiling the cracker: A survey of, and improvements to, password security
Klein, D. V. (1992) · Cited by 349
Securing passwords against dictionary attacks
Pinkas, B., & Sander, T. (2002) · Proceedings of the 9th ACM conference on Computer and communications security · doi:10.1145/586110.586133 · Cited by 307
Human selection of mnemonic phrase-based passwords
Kuo, C., Romanosky, S., & Cranor, L. F. (2006) · doi:10.1145/1143120.1143129 · Cited by 212
Cited by
The Science of Guessing: Analyzing an Anonymized Corpus of 70 Million Passwords
Bonneau, J. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.49 · Cited by 687
Wang, D., Cheng, H., Wang, P., Huang, X., & Jian, G. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2721359 · Cited by 499
A Survey on Systems Security Metrics
Pendleton, M., Garcia-Lebron, R., Cho, J.-H., & Xu, S. (2017) · ACM Computing Surveys · doi:10.1145/3005714 · Cited by 283
(2017) · doi:10.1145/3133956.3134067 · Cited by 187
Blockchain based approach to enhance big data authentication in distributed environment
Abdullah, N., Hakansson, A., & Moradian, E. (2017) · 2017 Ninth International Conference on Ubiquitous and Future Networks (ICUFN) · doi:10.1109/icufn.2017.7993927 · Cited by 72
Metadata
- Authors
- Dell'Amico, M., Michiardi, P., & Roudier, Y.
- Venue
- 2010 Proceedings IEEE INFOCOM
- Publisher
- IEEE
- Published
- 2010-03
- Pages
- 1-9
- OpenAlex
- W1487941708
- Cited by
- 290
- References
- 14
- FWCI
- 8.10
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Password Strength: An Empirical Analysis. https://app.cochat.ai/papers/10.1109/infcom.2010.5461951
- The paper
- Dell'Amico, M., Michiardi, P., & Roudier, Y. (2010). Password Strength: An Empirical Analysis. 2010 Proceedings IEEE INFOCOM. https://doi.org/10.1109/infcom.2010.5461951
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
