That means your 11 character, human-generated password has more like 4+(27)+(52)=26 bits of entropy. 226 is 67,108,864. Even at just 1000 guess per second, you only need 67,000 seconds, or about 18.5 hours to guess your password – and that's if you have to guess them all. On average, you'll only need to check half – reducing guess time to ~9.5 hours. And starting with sources like Have I Been Pwned , a probable wordlist , the known prevalence of leet-speak substitutions, etc, that guess time is likely reduced to minutes.
Add to this that you're likely able to check 10-1000x as many passwords per second (depending on methodology) … and your search time is exceptionally short
September 11, 2019 at 04:52PM
via reddit https://www.reddit.com/r/security/comments/d0eqow/are_these_types_of_passwords_i_use_secure_enough/ezx9liy?utm_source=ifttt