IN.gov - Skip Navigation

Note: This message is displayed if (1) your browser is not standards-compliant or (2) you have you disabled CSS. Read our Policies for more information.

Amber Alert
Amber Alert - TEST
  • password_reset_widget
  • custom_app_dev_widget
  • PC_Refresh
  • service_rates_widget
  • itp_widget

Indiana Office of Technology

IOT > Security > Matters of Interest > Brute Force Cracking Brute Force Cracking

Requiring eight-character passwords and adding mixed case, numbers, and special characters, makes it nearly impossible to crack through a brute force effort with the technology available today. The figures below show estimated times to crack password combinations, assuming 100,000 encryption operations per second (source: geodsoft.com).

Password Time to Crack Description
gcbwts 25 minutes Six lower case letters.
gcbwtsbn 12 days Eight lower case letters.
gc12bwt1 5 months Eight lower case letters with numbers.
Gc12Bwtl 8.5 years Eight mixed case letters with numbers.
Gc!12Bw% > 72 years Eight mixed case letters, numbers, special characters.

As technology becomes faster, the time to crack passwords will shrink. The standard of eight characters using mixed case, numbers and special characters will provide the state with a needed additional level of protection.