Password Security · Storage Scale

Password Dictionary Storage Requirements

Compare the theoretical storage needed for exhaustive password dictionaries as password length and character-set size increase.

Dictionary storage by password length

Solid curves show password rules; dashed lines show familiar storage limits.

record size = length + 1 byte
This chart requires JavaScript and a browser that supports canvas.

Interactive values

Move across the graph or use the slider to compare every line at one password length.

Focused view: password lengths 8–15

The same data on a reduced scale makes the practical storage threshold easier to see.

focused teaching view
This chart requires JavaScript and a browser that supports canvas.

Interactive values

Move across the graph or use the slider to compare every line at one password length.

How large would the storage planet need to be?

Earth represents an illustrative global aggregate storage baseline; the second body shows the exhaustive dictionary requirement.

volume-scaled teaching model

In this model, Earth represents a configurable global storage capacity. Required body diameter grows by the cube root of the storage ratio because the comparison is based on spherical volume.

Earth baseline

Earth = 100 ZB global storage baseline

Earth storage baseline Earth represents an illustrative aggregate storage capacity of 100 zettabytes. Earth diameter: 12,742 km

Required storage body

76-character set, 14 characters

Required storage body A logarithmically compressed circle representing the required storage-body diameter. Required diameter
Milestone: gas-giant scale
Dictionary storage
Loading…
Required diameter
Loading…
Nearest comparison
Loading…
True Earth ratio
Loading…
All character-set rules at the selected password length
Rule set Storage required Required diameter Nearest comparison

Visual diameters are logarithmically compressed so Moon-, planet-, star-, and orbit-scale comparisons remain visible together. Numeric labels show the true calculated values.

This is a simplified precomputed exhaustive-dictionary model. Real attackers rarely store every possible password, and salting, key stretching, and memory-hard hashing make precomputation less useful.

The question is no longer whether the attacker has enough storage. The question is whether the universe has enough convenient metaphors.

Reading the vertical scale

The y-axis uses familiar decimal storage units and large-number names. The spacing remains logarithmic: each major step represents 1,000 times more storage.

What this model means

These are theoretical exhaustive dictionary sizes, not password-cracking time estimates. Real attacks use filtering and prioritisation rather than storing every possible candidate.