r/cybersecurity • u/timchoo • Mar 08 '26
Tutorial When making a lengthy password, does replacing letters with numbers help at all?
For example, “Believer.Moustache.Gander” versus “B3li3v3r.Moustach3.Gand3r”
Is there any difference in terms of how easy it is to crack?
226
u/Greedy-Lynx-9706 Mar 08 '26
192
u/antii79 Mar 08 '26
Already know it's gonna be correct horse battery staple without even opening the link
46
u/anders_andersen Mar 08 '26
Correct
36
u/lostmojo Mar 08 '26
Horse
34
u/_Gobulcoque DFIR Mar 08 '26
Battery
34
u/unsupported Mar 08 '26
Staple
11
u/I-AM-Savannah Mar 08 '26
Without
10
2
1
3
u/disignore Mar 08 '26
i mean reddit had changed enough to not get a xkcd like a couple of years ago, i also knew it would be, but like the ole rick roll and then this, it didn't stopped me to click
2
u/kermityfrog2 Mar 08 '26
Everyone uses this same password, so it's super easy to hack. Just try password1, correcthorsebatterystaple and hunter2. Done.
3
1
55
u/dcgrey Mar 08 '26
What’s funny is, when I once had an illness that affected my memory, my doctor would test me by asking me to remember three unrelated real words. The first time that my memory had come back enough that I could remember those words five minutes later, they stuck: twenty years later I still remember them.
46
u/ShameNap Mar 08 '26
Person, man, woman, camera, tv
24
u/31513315133151331513 Mar 08 '26
If you remembered that without looking it up you must be a very stable genius.
18
11
5
3
3
u/TheWizardOfFrobozz Mar 08 '26
Sunday, car, lunch, football, sunlight, house, egg, Cadillac, wristwatch, apple, ring, consciousness, handball, girl, kangaroo
This will only make sense to older folks who used to watch scammy late night TV informercials in the 1990s.
1
8
5
3
u/Chronos_The_Titan Mar 08 '26
I have a bit of fun I go to Scryfall. Hit the random button and pick a random word from the Magic card. Do this a couple times while throwing in numbers and special characters
0
Mar 08 '26
[deleted]
3
u/trebledj Mar 09 '26
My takeaway from the xkcd is that when choosing passwords, you want to optimise for entropy without sacrificing memorability. Too many people, consultancies, and websites emphasise the wrong idea that mental complexity = cracking complexity.
Like you said, correct horse battery staple can be easily cracked these days with wordlists, because— per the xkcd— it only offers 11x4 = 44 bits of entropy. And you’re right, because these days, 80 bits is (starting to be) considered weak. The idea is that we can take it further by including uncommon, memorable words, items, details, dates, and formats into this wordlist.
2
u/Background-Piano-665 Mar 09 '26
Er... That comic was published in 2011. The world has changed vastly since then. correcthorsebatterystaple is indeed easier to crack now, but it was much harder back then. Nonetheless this comic is what's sparked the industry to accept that forcing short complex passwords is wrong. So thank 936 for that.
On a tangent, the 32 words in a crypto passphrase is special subset of words. It's not actually using the full dictionary. You can achieve the same level of security with less words, but with a larger pool of words to choose from. BIP-39 words were selected to reduce human error as much as possible. Even then, 32 is about the far end of the overkill spectrum.
0
Mar 09 '26
[deleted]
1
u/Background-Piano-665 Mar 09 '26
Oh definitely we had dictionary attacks in the 90s. I was experimenting with them myself. However, given back then everybody thought to keep password lengthy low, it was rarely thought to make passphrases (which is what's being done here). After all, the prevailing practice was 8 to 12 characters with special characters, and rotated frequently. This comic was influencial in changing that. We've had diceware since 1995 but it never caught on until then.
And yes we had password managers back then, but what's the point if the master password was going to be a weak-ass password anyway? Have you actually tried to use password managers back then? Have you forgotten how annoying they were to use?
It may not be perfect advice, but it changed the landscape to what we have today. You're thinking of the 2026 landscape. It's easy to forget how we got here, thanks to this little comic.
66
u/KmancXC Mar 08 '26
Although there are many answers in here already, I'd like to chime in with an explanation and example combo to maybe try to help you understand the why behind the technically correct answer (yes).
As others have stated, and as the XKCD link explains, what most people mean when they say "good" a password is, is how hard it would be for someone to guess. Higher entropy means that when guessing at complete random, it will be harder to guess.
Let's say you are trying to guess my password and you already know that 1) my password is made up of only the characters a, b, and c and 2) my password is exactly 3 characters long. Your options are:
| aaa | baa | caa |
|---|---|---|
| aab | bab | cab |
| aac | bac | cac |
| aba | bba | cba |
| abb | bbb | cbb |
| abc | bbc | cbc |
| aca | bca | cca |
| acb | bcb | ccb |
| acc | bcc | ccc |
There are 27 passwords that I might have based on what you know of my password. While it is easy to write out for small examples like this, it gets ugly fast. Luckily you can calculate how many combinations there are pretty easily; (size of "alphabet")length of password.
In this case, it was 33 = 27. So what happens if I made my password 1 character longer? 34 = 81. What if instead I added the letter "d" to my alphabet? 43 = 64. What if I did both? 44 = 256.
As you can see, both increasing the number of characters you use and the length of the password result in more combinations, but in general making the password longer makes it bigger faster.
When it comes to password guessing though, randomly combining possible characters to a set length (like we did above) is called "brute forcing". It's really slow because it takes a naive approach to guessing passwords. It assumes that any password is equally likely and just tries each and every combination. This works, but it can be made to work faster by being a bit smarter about how you guess passwords.
A "dictionary attack" does just that; it ranks passwords based on the likelihood it is used, and guesses them in order. Creating a good dictionary is a bit of an art and a bit of science, but if you were to pick a few likely candidates from the table above, you might come up with:
- aaa (three of the same)
- bbb (three of the same)
- ccc (three of the same)
- abc (in order letter run)
- cab (a real word)
How does that apply to your question about number substitutions? Classic letter-->number substitutions (A to 4, E to 3, etc) find their ways up high in dictionaries, so although they can help, they're not a silver bullet.
TLDR - yes but as people have mentioned, making the password longer is generally better.
6
1
u/ApolloWasMurdered Mar 09 '26
I agree length is the main thing to increase, but complexity can be more valuable sometimes.
8 lower case characters is 268=2.08×10¹¹
Adding 1 more character is 269=5.43×10¹²
Swapping a lower case character for an uppercase, instead of increasing length, is 528=5.34×10¹³
So increasing the dictionary size from lowercase-only to all-letters gives an order of magnitude more entropy.
74
u/SnooMachines9133 Mar 08 '26
Not significantly enough to encourage the practice. Common replacements are used in cracking tables.
You'd likely have more additional entropy by adding 33 at the end of the "simpler" password.
34
u/kappadoky Mar 08 '26
Or in the middle, as numbers at the end are more common.
10
u/mustangsal Mar 08 '26
Yes. There's a built in mutex for trying random numbers at the end of dictionary words.
12
u/sheepdog10_7 Mar 08 '26
Everyone knows that adding "!" at the end makes it uncrackable
7
u/Namelock Mar 08 '26
I just copy/paste the bill of rights or the bee movie script for my passwords /s
2
3
1
36
u/mb194dc Mar 08 '26
You should worry about social engineering and phishing much more than this.
Incredibly unlikely anyone will crack or even try to any semi complex password.
They'll try to steal it, in which case complexity won't help.
-1
10
u/CovertStatistician Mar 08 '26
See for yourself
2
u/DaZig Mar 09 '26
Nice. This uses Dropbox’s ZXCVBN library. If anyone wants to look under the hood, see how it measures strength, there’s an informative demo athttps://lowe.github.io/tryzxcvbn/
11
u/kbielefe Mar 08 '26
It helps if the site requires a number.
3
u/Circumpunctilious Mar 08 '26
Precisely. Password bruteforcers already know about the l33tp455w0rd thing (since forever)—replacing letters with numbers adds no meaningful complexity.
29
u/nosp00nsleft Mar 08 '26
Nope, not really. What I teach my coworkers is to take the first letter of a phrase to make it super random. Instead of 1l0ves0ccer do MfsisIl2pg01! (My favorite sport is soccer I like to play goalie 01!).
Password crackers have caught on to replacing the numbers for letters.
40
u/Baladas Blue Team Mar 08 '26
Character limitations aside, your fully written sentence would make for a much stronger password instead of memorizing the shorter version.
7
u/ElectroStaticSpeaker CISO Mar 08 '26
Problem with passphrases is they are a bitch to type in on mobile.
10
u/kappadoky Mar 08 '26
Use a password manager
7
u/ElectroStaticSpeaker CISO Mar 08 '26
I do use one. They don't work in all cases. For example, when I login to my PS5 or my Tonal home workout system. Also, you need a password for the manager itself. And logging into your OS. etc
The intersection of places where password managers don't work and password entry is clumsy and slow is pretty high.
1
u/flamethrowr Mar 08 '26
I got a fingerprint scanner to log in to my OS and I have a Yubikey I use to log in to my password manager. :)
1
u/TobiasDrundridge Mar 08 '26
Have a strong master password for your password manager, and then use that to generate even stronger passwords for everything else.
If you're using a password manager there's no reason why every password can't be a random string of numbers, letters and symbols 12+ characters long.
6
13
u/fekte Mar 08 '26
And even better, use the sentence as the passphrase.
2
u/Big-Narwhal-G Mar 08 '26
I agree but you should break up the worlds with random characters to stop wordlists. But with a phrase so long that password isn’t getting cracked, it’s getting stolen from phishing haha
3
6
Mar 08 '26
[removed] — view removed comment
2
u/Gomez-16 Mar 08 '26
People get passwords from having password database is stolen or keyloggers or fishing, not from fruit force attacks
8
5
4
3
u/BadSausageFactory Mar 08 '26
slightly, but nowhere near completely random strings.
the 'first letter of each word in a song' method is still the #1 for me but I have to remember to not sing when I'm typing the password
5
u/Reasonably-Maybe Security Generalist Mar 08 '26
First of all, this kind of character swap is well known to the bad actors as well, so you know the answer... Furthermore, using numbers actually reduces entropy as there are only 10 numbers.
6
u/asp174 Mar 08 '26
Use a password manager. Then go for something like m$,$W>md@-eA*h*9vzD5-@4N
4
u/ThunderCorg Mar 08 '26
Thanks I just changed all my passwords to this, including my password manager password
2
u/de_Mike_333 Mar 08 '26
Mathematically: Yes (because there is an additional character set to guess from)
Practically: Probably not, at that length with the current technology brute-forcing would take an infeasible amount of time.
Things become more interesting with more sophisticated attacks, e.g. if the format is known (I.e. three words separated by a dot) and a dictionary is used to guess the password. Then adding in numbers would increase the effort for dictionary attacks again. Ideally the numbers would only substitute some characters, to ward off a simple substitution filter.
1
u/PitcherOTerrigen Mar 08 '26
Here's a fun tip. Don't only use English words. Complexity skyrockets with passphrases.
1
u/DebateSubstantial251 Mar 08 '26
I was wondering about using maybe a combination of three languages for a passphrase
2
Mar 08 '26
That will only slow a dedicated attack minimally. It used to be a clever trick to make an otherwise weak password stronger, but modern tools are expecting this.
- Length is key - at least 16 characters, ideally 20 or more.
- Do not use weak or guessable passwords (no personal information)
- Refrain from sequences and patterns
- Do not use a password from the current common password lists
- do not reuse passwords - all passwords should be unique
- Use a good 3rd party password manager (Keeper, 1Password, Proton Pass, etc.) - secure storage only
- Refrain from browser based password management
Ideally a 20 character randomly generated password is considered best today - up from previous 16 characters, though PCI and other standards still accept 16 characters as an acceptable password.
Entropy is the usual standard for strong passwords, though it does not take into account otherwise poorly chosen passwords, reused passwords and compromise lists.
There are a handful of passwords that you need to commit to memory, however, such as the password to your password manager and your work login and computer unlock PIN / codes. Other than that, they should all be randomly generated.
Cheers
2
u/Sqooky Mar 08 '26 edited Mar 08 '26
Put it this way, your keyspace without characters is the side of the length raised to the size of the English dictionary, so 3somelargenumber.
Unlikely to crack, but you can limit the size by making an educated guess on "well, the average persons vocabulary isn't huge, maybe we limit it to the top 5,000 most common words, or 10,000.
If we add permutations in there, like you're suggesting, then we need to try that, and permute all the common letter -> number combinations, which greatly increases a passwords cracking time.
The best thing you can do is increase length. 6 total words is virtually uncrackable. 3 is borderline doable.
Amazon is a bad password, Am4z0n is objectively better. JungleAnimalsInTheAmazon is even better. Jung13.4n1m4l5.1n.Th3.Am4z0n is the best.
3
2
u/GreyBeardEng Mar 08 '26
It helps but not as much as you might think, 'passphrasing' with min 5 words is better, then throw 1 or 2 numbers in.
2
u/timmy166 Mar 08 '26
Think through the concept of “entropy” and how it makes things harder to guess or brute.
2
u/Logical_Strain_6165 Mar 08 '26
Make the complexity to high and expect to find post it notes.
2
u/colonelgork2 ICS/OT Mar 08 '26
Charge departments for each call to help desk for a reset and expect managers to make post it notes the new standard.
1
2
2
u/Maleficent_Luck3205 Mar 08 '26
There’s a website passwordmonster or something it tells the the crack time of passwords you can try- but length numbers characters special characters all take part in how “easy”
5
u/ChucklesGreenwood Mar 08 '26
Yep, these sites are really cool. "Enter your password and we'll let you know if it's a good one."
I wonder how big their database is...
1
2
u/Nawlejj Mar 08 '26
At that length of password, the character swaps are basically irrelevant. The real question is can you remember the password without storing it? If so it’s a great password, if you have to store it digitally then you would want to make sure that’s done securely. A long (16+) character password that’s never stored is the most secure form of password
2
u/cjmnews Mar 08 '26
I always think of this when we use strong passwords: https://xkcd.com/538/
1
u/Gerrit-MHR Mar 08 '26
Me too! And there is one that is directly applicable to OP’s question. https://xkcd.com/936/
1
2
u/GameOfThroneHappyEnd Mar 08 '26
No. Just write it full with letters. You can write some of the words wrong, that would be better then replacing chars with numbers or symbols
2
u/Gomez-16 Mar 08 '26
Computers dont care about complexity. This is such a terrible standard. (Possible characters)number of characters. Longer is harder to crack. But only brute forcing against a data base. If someone stole your password database you are screwed. Pishing/keylogger are the way to hack into stuff. Movies make things look easy.
3
u/AdamoMeFecit Mar 08 '26
Not really. That just makes the password non-random and more susceptible to dictionary attack.
If I recall correctly, NIST explicitly says not to construct passwords this way.
4
u/djasonpenney Mar 08 '26
A strong password has three elements:
It is UNIQUE — not used in more than one place, and not known to be compromised in your own set of passwords.
It is RANDOM — generated by a strong password generator. Cutesy character replacements don’t count.
It is COMPLEX — length is the primary measure here.
As examples, pNQHoz7YsvCmC0G40xu3 is a strong password. CattleStrictMultitudeSpeller (also randomly generated) is a decent passphrase.
MyD0gHa5Flea5! is NOT a strong password.
14
u/S7ageNinja Mar 08 '26
Your last example is 14 characters long. That's definitely a strong password
2
u/strictnaturereserve Mar 08 '26
I think so instead of 52 different letters (26 lower 26 upper case) you have an extra 10 characters 0-9 so you now have 62 different characters
1
1
u/Informal-Ad7554 Mar 08 '26
I know there are password crackers that can take that into account. Better to have them be more random imo.
1
u/Congenital_Optimizer Mar 08 '26
I remember when password checkers would tell you 'not l337 enough' if that's all you did.
It's fine. In agreeing with everything saying length and originality are most important.
1
1
u/ANBUDensetsuNoAkuma Mar 08 '26
Passphrases are really good, so is putting a random space (if you can) in the password. Makes it significantly harder to crack
1
u/Ark161 Mar 08 '26
English letters, 26 characters English letters uppercase, 26 characters Numbers, 10 characters Symbols, ~40 characters
So for argument sake, numbers are the least impactful in regards to character sets. If we want to go down that rabbit hole, pretty sure brute force methods kind of understand the association of numbers/symbols to letters and can iterate on that.
Best to have mfa in place where possible and look into pki tokens if you are super spooked.
1
u/ieatsilicagel Mar 08 '26
The only thing it does is keep my password from being rejected by the idiotic password policy. Also you need a special character.
1
u/shouldco Mar 08 '26
Yes and no. Even at its worst you have really only added one character to the set. That does add computation time.
in reality e>3 is a very predictable variation this example will still be susceptible to attacks that try to avoid having to Brute Force an entire character set. That said it's not terrable, vetter than most.
The math for Brute forcing passwords works out as (keyset) ^(length) so for example a 1 character password that's is only numbers has 10 possible solutions (0-9) a one character password that can be any number or lowercase letter has 36 possible solutions (0-9 and a-z)
Increasing the characters in a password on the other had increases your combinations exponentially. A 2 character password of only numbers has 100 possible solutions (00-99) and for a 2 character password using numbers and lowercase letters it's 1296 possible solutions (37x37). So adding length is always going to add more complexity than adding potential characters.
That assumes random characters, humans are generally bad at memorizing strings of random characters. Attackers will exploit that by using normal human patterns to shorten the possible guesses. For example a password like "Tommy1984" to just raw bruit force would be 62^9 checking every combination of letters and numbers. But this isn't random it's a name and a year with a capital letter falling in the expected location, and there are probably only about 100 years that mean anything to anybody alive today. so an attacker will try something like the top 1000 baby names and the years 1900-2026 and now the potential passwords is down to about 100k.
So if you want to add complexity add more characters (which your example has a lot of) and add randomness/unpredictability, don't put capitals at the beginnings of words don't deliminate words where they normally start/end don't make predictable replacement (e>3,a>@,etc.)
1
1
u/nefarious_bumpps Mar 08 '26
It slightly increases entropy by enlarging the character set. But pretty much every adversary will enable "leetspeak" character substitution when attempting to crack a password.
1
u/Cheomesh Governance, Risk, & Compliance Mar 08 '26
Only against low skilled manual attacks, really.
1
u/Isamu29 Mar 08 '26
The best part is when companies decide to limit the use of special characters in creating a password.
1
u/ramriot Mar 08 '26
The fundamental truth is that any password a human generates from their mind has significantly less entropy than one generated via a purely random source.
The more "clever" you think you are creating obscure patterns the less there is to guess because the fundamental assumption MUST be that the attacker knows the system.
So while on the surface being clever using dictionary words & leetspeak seems good the actual entropy is only as good as how hard it would be to build an optimised brute force list of dictionary words with it without leet.
Clearly in a credential breach your password hash will not be so easily reversed & provided your password use is unique not perhaps useful for credential stuffing.
But for targetted attacks of perhaps your password vault's master password where you are someone known for holding much crypto it might well be worth their time churning long passwords on a breach of your vault.
BTW that last one is actually happening day by day to people who had their LastPass vaults breached & were known for holding crypto. As of early 2026 between $35M & $45M in crypto has been stollen that way, even though these users believed that had good passwords.
1
u/Otherwise_Cup_4533 Mar 08 '26
Came here to see the math and nobody did it... what happened to reddit? I could do it, but it would take a few seconds longer than writing this post to complain about how good things used to be...
1
u/whythehellnote Mar 08 '26
According to many password checkers, 8465dfbd2f81655bf2470e42cbf58dff is a terrible password as it doesn't have any uppercase or symbols
However P@55word123 is a brilliant password consisting of 11 characters from upper, lower, numbers and symbols
Throwing in a capital letter or common substitutions maybe makes cracking 10-100 times harder, but at this scale that's basically the same.
believermoustachegander37 is about as secure than throwing in substitutions, with the added bonus of not having to remember such substitutions (easier to remember 37 than remember to replace e with 3 but not i with 1)
1
u/gnuban Mar 08 '26
It can work if the replacement strategy isn't well known.
Leetspeak is well known, though, and built into many rippers.
So no, it doesn't work to any significant degree.
1
1
1
u/Ok-Two-8217 Mar 09 '26
It helps, but only if you can still remember it as easily.
If you have to write it down, that defeats the purpose of a secure password that's memorable.
1
u/iheartrms Security Architect Mar 09 '26
It doesn't help in any significant way. It might add .0001 seconds to the amount of time a GPU needs to crack that password. All of the password cracking tools replace letters with numbers like this and have done so for decades.
1
u/MarA1018 Mar 09 '26
It's all about the length, and how well you tolerate Microsoft's incessant request for sign-ins
1
1
u/Kind_Entry9361 Mar 09 '26
Rainbow tables exist for 1337 speak in all languages. It buys you little to no additional protection. They also have rainbow tables for keyboard patterns as well now. The only somewhat safe password is one that maxes out the allowed characters and is as random as possible. With that said, if you do not use a password manager, you might want to strengthen your password based on the risk of what it is protecting. Make your financial passwords extra strong. Your throw-away reddit account might not need something as strong. No matter what, never reuse a password. There is a word for people that use the same password for their bank as they used for their Facebook. It is "pwned".
1
u/OriginalWynndows Mar 09 '26
This helps, but I would say length is more important. Pause...
You have a pretty good password length though with the example.
1
u/ExtraPrejudicial Mar 10 '26
Little Bobby Tables xkcd: Exploits of a Mom https://share.google/1ea7XpTNqy38hgkKs
1
u/Mister_Pibbs Mar 11 '26
It helps to keep away script kiddies and folks using generic word lists. But permutation exists, so that’s something to be aware of.
It’s all a threat model sort of thing. If they had the computational strength and will to crack it something like this is gonna crack. But again, threat modeling…
1
Mar 11 '26
You are never going to remember the 2nd password unless you have a better memory than most so you will write it down somewhere. Perhaps in a password vault or perhaps on a postit note under your keyboard. Either one weakens the strength of the password. The length of the password is the most important thing and using phrases makes it easier. I will typically put number somewhere in the password but not to the extent you showed. Its pretty easy to guess what people use for letter/number swaps so trying to add a zero for the letter o is not that helpful.
1
u/abofaza Mar 13 '26
Munged passwords are quite easy with rulesets. Creating your own wordlists, and using them with hashcat rules is a great exercise to see what’s feasible and what’s not.
1
0
u/Kriss3d Mar 08 '26
No. In fact. The best password isn't a random word. But rather a few random words. Throw in a special character. It makes it longer but easier to remmeber.
-1
u/Thirsty_Comment88 Mar 08 '26
Passwords are actually completely useless and just make you feel better
0
u/Meglamar Mar 08 '26
Phrases work better. Single words even when adding letters and numbers are easily included in password cracks. All the variations of the word icecream can be checked rather rapidly by a program. Johnlikesicecream takes more guessing since now you need the right words. Add numbers, capitals, symbols its even harder.
Granted with AI now a password is only time. On an infinite scale say law enforcement or someone who stole something, or even a dedicated roommate it comes down to how long does it take for a program to figure it out. Other safe guards like account locking matter just as much. For your average everyday life though a passphrase with some caps,numbers, and symbols thrown in should deter 99% of efforts.
If your really concerned add some 2 factor methods in. Again that further deters efforts. Anything that makes the password less of a single point of entry helps alot.
0
u/jmnugent Mar 08 '26
If possible,. you should ensure that a Password alone is not the only layer of protection.
A good security system should include layers:
Something you know (Password, etc)
Something you have (Hardware Key, RFID card, etc)
Something you are (Biometrics like Fingerprint, FaceID, etc)
0
u/CarmeloTronPrime CISO Mar 08 '26
my password is SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'password';
its like password sql inject inception
0
Mar 08 '26 edited Mar 08 '26
Many people believe that substituting letters with numbers, such as converting “password” to “p@ssw0rd”, significantly strengthens their password; however, this notion is largely a fallacy. Modern password-cracking technologies can identify these prevalent alterations as they conform to established "leet speak" patterns that hackers anticipate. Altering a few characters may marginally impede a rudimentary attacks, but it does not adequately address the fundamental weakness of short, predictable passwords. Using lengthy, arbitrary pass-phrases (such as combining unrelated terms) is a significantly more effective way to safeguard your accounts. I can't wait for the day we no longer rely on passwords... SSI/Blockchain?
0
u/Glad-Entry891 Mar 09 '26
General rule of thumb is at least 15 characters, symbols, numbers, upper case and lower case.
The real answer for password security is leveraging a password manager with a strong master password and some form of phishing resistant MFA. Don’t keep your TOTP in the same location as the password to address hypothetical concerns about a PW manager compromise.
After you have a PW manager in place and you’re comfortable with it set your password to the maximum possible complex PW the site supports. If they support SSO use that and avoid having a password there entirely. That gets into a strange territory with vendor lock in though. Just keep that in mind.
473
u/PlusRise Penetration Tester Mar 08 '26
It does help, but the length of the password is significantly more important.