Gfyuki

As you noticed, it doesn't have any symbols, which makes it weaker than a password of similar length which does, but there's no other 'obvious' defect with this password. A password does not have to use symbols to be strong, as long as it's long enough (obligatory XKCD link).

But, now that this password appears in plain text on a website (dedicated to passwords), it's likely that some attackers will include it in their dictionary. After all, there might be users less proficient in English, or audacious types, who still use this password since it looks random and reasonably long. In this way, saying "Gbt3fC79ZmMEFUFJ is a weak password" is some kind of self-fulfilling prophecy.

There is nothing wrong with this password, other than it being published somewhere on the internet. The password is 16 characters of varying upper case, lower case, and numbers. This equates to a search space of 62^16, or about 95 bits of entropy. This is massive, and can't be brute forced.

So why did the author of this website consider it a bad password? Being published on the internet is unlikely to be the reason. A list of "good passwords" is also included, which are obviously also published on the internet, making them immediately "bad passwords" using this line of thinking.

The most likely scenario is the author doesn't understand password entropy, and thinks that passwords MUST contain special characters. This is simply false. Entropy is a function of the number of possible symbols, AND length.

If generated at random, the entropy (in bits) can be calculated by log2(number-of-symbols^length). For an alpha-numberic with variable case, this is simply log2(62^16), or about 95.

The rub is of course most passwords are NOT generated at random, so this simple formula isn't often useful.

It looks like the password is made up of runs of randomly typed characters on a QWERTZ/QWERTY/AZERTY keyboard that are highly clustered together.
This is most pronounced on a QWERTZ keyboard:

Image based on KB Germany.svg from Wiki Commons.

Here, the coloured keys are those of the password with the hue indicating its position in the password (going from blue to green).
You see that the characters cluster together, and this is even more pronounced for characters of similar hue (i.e. characters that are are close to each other in the password). In addition to that, the clusters seem to clump near the home position on the keyboard.

I must admit that I am not knowledgeable enough about password cracking software / password databases to say definitively whether or not such clusters are taken into account, but it is at least something that I noticed myself when I try to type random characters on the keyboard that they don’t actually come out very random in the end. And if I have noticed that, probably some author of some password database has, too.

The complete paragraph is:

5. Do not use any dictionary word in your passwords. Examples of strong passwords: ePYHc~dS*)8$+V-' , qzRtC{6rXN3NRgL , zbfUMZPE6`FC%)sZ. Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword.

So it looks like it should be an example of a bad password because it uses "dictionary words". At first sight, I cannot recognize any words there. However, I tried to look up its parts on Wikipedia (English), and it looks like there are articles for all of its parts.

GBT, 3f, C79, Zm, MEF, UFJ.

However, this would be pretty far-fetched. It would be like saying that, considering Wikipedia as your dictionary for words, a six-word passphrase would be insecure. No way! A six-word passphrase with random entries from Wikipedia would be very secure.Of course you can say that that password is now insecure because it's written on the internet, but that would have been true of every other possible example then, even for the examples of strong passwords. I also tried looking it up on haveibeenpwned, and the result was: "This password wasn't found in any of the Pwned Passwords loaded into Have I Been Pwned". Another explanation, which is probably the real reason why that example was given, is that the password can be found online in some code if you Google it (see here), as was pointed out in another answer. So by "dictionary password", the authors maybe meant "any password that has ever been written somewhere, including the internet". However this is yet again nonsensical advice: how are you supposed to follow that advice? Should you start looking up your password in lots of places (including Google, maybe even leaving traces in history), just to be sure it doesn't already appear anywhere? That doesn't sound like a great thing to do.

In conclusion: it's a bad example and it's been given in the wrong context. People are going to see that and interpret it like "oh, there are no symbols, I should use symbols". The real reason why it's been included in that list is unknown though, and there appear to be no explanations that truly make sense. If someone felt like wasting some time, they could try contacting the owner of that website and ask them.

This is a misleading statement. "Gbt3fC79ZmMEFUFJ" is a strong password in practice. It won't be caught by anything but a brute force attack on it (no dictionary words) and it's sixteen characters, which is way above the common standards I see (8 or 6). This password might only be considered weak if the attacker somehow knew no symbols were used. If the account this password is attached to publicly says "only numbers and cap/lowercase letters" then this password might seem weaker for the sake of making an example, but it's actually still better than an 8 digit password.

So, for a 16 character password using capital letters, lowercase letters, and 0-9 digits, entropy is 62^16 = ( 48 x 10^27 ) vs using an 8 characters password with all symbols (we'll even assume 96, not 72 characters) is 96^8 = (7 x 10^15 ). This is a massive difference.

The reason for this confusion is the example is oversimplifying the basic advice to use a Capital, lowercase, digit, and symbol. In actuality, the length of the password is far more critical and also in practice the attacker would not be able to know that the full character set wasn't used and would actually still have to brute force 96^16.

While Gbt3fC79ZmMEFUFJ is certainly a poor choice of password now, seeing that your question has generated a lot of activity on Stack Exchange and has thus widely published the password, I don't think there is any discernible reason we can pin down for why it would be bad in the first place, because, quite frankly, the website that you have cited is terrible.

The source that you're drawing from appears to be a loosely organized list of security tips of low to middling quality. Some of the tips are good (e.g. use 2-step authentication whenever possible, lock your computer and mobile phone when you leave them), but some of them have been questioned by security experts (e.g. change your passwords every 10 weeks, use at least one uppercase/lowercase/number/symbol) and quite a few seem downright paranoid (e.g. tip 22, which states that if you have a WiFi router in your home, nearby attackers can detect what passwords you're typing in because of changes in the WiFi signal from moving your hands, and that using an on-screen keyboard with random layouts will mitigate this).

And while it is probably not an issue that most of the tips are poorly proofread (with many spelling errors and punctuation inconsistencies), it is an issue that absolutely none of the tips are cited, and that the whole website is anonymous. There are no quotes from security experts, no articles that we can read up on for further information or discussion. And the website contains absolutely no author information - nowhere on the website, or even in the website's Whois registration, is there any way to contact the author or even know who they are.

This essentially means that we have little to no way of determining how good of a tip "Gbt3fC79ZmMEFUFJ is a weak password" is, or what it even means. We certainly have no way to contact the author of this website and ask them ourselves, and I actually doubt that it would even be useful to do so. I think that we are best off ignoring this suggestion, taking way only the fact that Gbt3fC79ZmMEFUFJ should not be used because we talked about it at such length.

TL;DR: Passwordsgenerator.net is bad - just ignore it.

As an addendum, you may be interested in some other things I found when I was inspecting the website itself, to get better context on what it was and perhaps find more information on it. What I found wasn't very pleasant:

• The website provides an option (default checked, but still) to not generate the password on the server. I did look at the source code and the network traffic view in the Dev Tools window, and it does, in fact, honor this request, but there's no way to tell that it actually does that without reading it.


• The generator users Math.random()! Math.random() is a cryptographically insecure random number generator, making the generated passwords surprisingly predictable and actually far fewer in number than you'd be led to believe - for instance, if your implementation of Math.random() has only 32 bits of state, then regardless of what settings you use, only 4 billion unique passwords can be generated, which means that any number of characters beyond 7 or so is meaningless. A true random password generator should instead use the window.crypto.getRandomValues() call instead, which sources every single bit of the password from a true entropy source somewhere in the computer.


• The password generator is also placed on the page strangely - the code for the generator itself is minimized, but the code for configuring it is not. It almost appears as if the website author copied the minimized password module from another source, such as another website.


• The website also tries to use Google Ads for some odd reason. It doesn't actually invoke them - it just has a signature at the bottom for adding the Google Ads ID to the window object - but any presence of actual ads will also potentially compromise any data entered into the page, even if the page is served over HTTPS.

Most people have been distracted by the strength/entropy of the password (it looks like something most password managers would spit out). The reason why the top answer's find makes your password weak is that it is almost certain to be part of a database of known passwords

"It's vastly different than it was [before] because of these massive password lists," said Rob Graham, CEO of penetration testing firm Errata Security. "We never had a really large password list to work from. Now that we do, we're learning how to remove the entropy from them. The state of the art of cracking is much more subtle in that before we were guessing in the dark."

If someone has a data breach, crackers will start with the known list of passwords and work backwards from there. That's why password managers are the new standard of security: you generate a random and unique password every time.

Strong or weak is somewhat arbitrary as it's based on length of time it would take to randomly guess it, which is a function of the entropy of the password. You can make it take longer by increasing character length, or increasing the pool of characters that can be in the password.

In the example you provide that's just upper/lower/digits, so that's a character set of 62. There are 16 characters, so that's 62^16 guessable combinations. Adding special symbols (let's just say 10), that puts the combinations up to 72^16.

Trying every single combination is a bit naive, but it's the most expensive attack, so you have a baseline to operate against.