I need help calculating the number of possible passwords with a given set of criteria. Here is the set of criteria:

  • Passwords are case insensitive.
  • Must be 6-14 characters.
  • Must contain at least 1 letter and 1 number.
  • Must not be equivalent to your current or 3 previous passwords.
  • May not contain 9 or more numbers.
  • May not be identical to your Username.
  • May not repeat the same number or letter more than 3 times in a row.
  • May not contain more than 3 sequential numbers or letters (such as '1234' or 'abcd') in a row.
  • May contain special characters (such as @, %, &, #).

Any help would be greatly appreciated.

  • $\begingroup$ What kind of passwords are case insensitive? $\endgroup$ – Mark L. Stone Apr 21 '16 at 17:06
  • $\begingroup$ The system changes the to lowercase and stores them that way. Not a good practice. $\endgroup$ – dprofancik Apr 21 '16 at 17:18
  • $\begingroup$ I think you need to state the rules more clearly. For instance, exactly how many special characters are there which are allowed (you listed 4 of them)? Ruling on '0123' , '7890', '9012', etc.? "May not repeat the same number or letter more than 3 times in a row" is ambiguous (specifically, "repeat") - does that mean "May not have the same number or letter more than 3 times in a row"? Results will vary with user and password choice time for previous password and Username rule, but that's at most a subtraction of 5 possible passwords. $\endgroup$ – Mark L. Stone Apr 21 '16 at 17:47
  • $\begingroup$ No problem. Assume all standard keyboard special characters (32 chars). No, '0123' would not be allowed, but '0987' would be allowed, as they are not numerically sequential. Yes, "May not have the same number or letter more than 3 times in a row". I generally know how to approach this problem by calculating on possible passwords, and then subtracting based on the criteria. I'm struggling with how to calculate some of the criteria. Thanks for your help. $\endgroup$ – dprofancik Apr 21 '16 at 17:55
  • 1
    $\begingroup$ Please do not cross-post. That is against SE policy. Decide which site you want your question on & delete the other version. $\endgroup$ – gung - Reinstate Monica Apr 22 '16 at 0:15

No one has provided an exact answer, so I'll discuss approximations. If you're content with an approximate answer, you could consider

I. Use simulation to estimate the fraction of all possible length j passwords composed of the 68 allowed characters (26 letters, 10 numbers, 32 special characters), i.e. $68^j$, which are in compliance with the rules. Do separately for j = 14, 13, etc. Multiply the fraction in compliance by the number of passwords of that length, and sum over lengths of 6 to 14. There might also be some clever ways to incorporate some of the rules restrictions into the simulated candidates, then estimate the fraction of those which are in compliance with the remaining rules.


II. An upper bound approximation (code strands are in MATLAB, but they should be understandable by all):

There are 68 allowed characters, so if no passwords were disallowed, there would be sum(68.^(6:14)) = 4.587e25 possible passwords.

For a length j password, there is $P$(no numbers) + $P$(no letters) - $P$(no numbers or letters) = $(58/68)^j+(42/68)^j-(32/68)^j$ probability of not having at least one number and one letter. The probability of not having at least one number is dominant within this. That comes out as follows:

   j    P(not having at least one letter and one number in password of length j)
   6             0.429706323418485
   7             0.357603415290630
   8             0.298900283824793
   9             0.250880451281631
  10             0.211340972742333
  11             0.178563920283941
  12             0.151226117928902
  13             0.128306817799266
  14             0.109011434066698

So, decrementing the total number of passwords of lengths 6 to 14 only by those disallowed due to not having at least one number and one letter, results in a total of


= 4.086e+25 passwords.

The probability of not having 9 or more numbers given at least one exceeds 0.99996. I believe that disallowance due to all other reasons would only contribute a "very small" decrement, although I have not quantified that. Therefore, the number of allowed passwords will be "a little less" than 4.086e+25, if I haven't made a mistake. I leave any further refinement to others. But this is probably "good enough for government use".

| cite | improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.