You can totally use emojis as passwords. You can probably even make this a policy at your company.
Edit: I thought this was an obvious enough joke, but just to clear things up: Only do this if you hate your company and everyone working there.
You can totally use emojis as passwords. You can probably even make this a policy at your company.
Edit: I thought this was an obvious enough joke, but just to clear things up: Only do this if you hate your company and everyone working there.
For somewhat more realistic numbers:
According to minerstat.com, an NVidia RTX 4090 has a hashrate of 118.07MH/s. This is 118.07 Megahashes per second, or 118.070.000 hashes per second. For a password with only 8 lowercase letters (208.827.064.576 combinations), it would take an RTX 4090 approximately 1769 seconds (or ~30 minutes) to go through all possible combinations. For an 8 character upper+lower+numbers password (218340105584896 combinations) it would take 1849243 seconds, or 21.4 days.
For an 8 emoji password (32482071647592311234920185856 combinations), it would take 275.108.593.610.504.896.512 seconds, or 8.723.636.276.335 years.
Lets say a magic prediction algorithm reduces the number of possible combinations in each password to 1 out of every 1 million previously possible combinations. 8 lowercase letters would be cracked instantly, while an 8 emoji password would still take 8.723.636 years.
These statistics aren’t entirely correct. There are 3664 emoji, so an 8 emoji password would take ½*3664^8 attempts to crack on average, or 1.6 * 10^28 attempts or about 10^20 seconds on a single 4070. That’s ignoring the fact emoji are more than one single byte; at byte level, an 8 emoji password is probably 24 bytes long, but it can be much longer.
Now, this number could be reduced by a dictionary attack (⚽ doesn’t get combined with gender or skin tone, generally) and emoji like 🏴 can increase the number (🏴 is one glyph but encoded in 28 bytes!).
In practice, though, I don’t think people would be able to remember whether they used 💙 or 🩵. That makes it rather unpractical for normal people to use. Also, software isn’t generally tested for this. The Steam Deck had a bug on release where it would crash and reboot if you opened up the emoji selection screen in the password field for initial setup, for example.
Just adding a single emoji to a password would probably make it uncrackable already, because brute forcing tools like John the Ripper don’t include these unicode ranges by default. Then again, so does adding 𓂸.