How passwords are attacked · 5 min read

Keyboard patterns and letter substitutions

Keyboard walks and letter-for-symbol swaps look complex but are among the first things guessing tools try. Here is how little they add, counted.

Two habits make passwords look stronger than they are. One is tracing a path across the keyboard: qwerty, asdfgh, 1qaz2wsx. The other is swapping letters for look-alike symbols: a to @, o to 0, s to $. Both produce strings full of symbols and digits that a simple meter will praise. Both are well known to anyone writing guessing rules, because both are on the lists that leak.

Keyboard walks

A keyboard walk is a sequence of adjacent keys. It is easy to type and easy to remember because the fingers do the remembering. The 10,000-entry common-password list bundled with this site’s checker includes qwerty at position 5, asdfgh at 98, zxcvbnm at 217, 1qaz2wsx at 662 (two columns walked downward, number row to bottom row) and qwertyuiop at 2,102.

Walks come in a few shapes:

• Straight rows: qwerty, asdfgh, zxcvbn, 123456, and the same rows reversed.
• Columns and diagonals: 1qaz, 2wsx, zaq1, moving down or up through the rows.
• Turns and repeats: a row then back, or the same short walk twice (qweqwe).
• Shifted versions: the same keys with Shift held, which turns 123456 into !@#$%^.

Worked example: counting straight-row walks

How many 6-key straight-row walks exist on a standard US keyboard? Take the four rows a walk is usually drawn from: the number row (1 to 0, 10 keys), the top letter row (q to p, 10 keys), the home row (a to l, 9 keys) and the bottom row (z to m, 7 keys).

A row of n keys contains n − 6 + 1 runs of six adjacent keys:

Each run can be typed left to right or right to left, so there are 16 × 2 = 32 straight 6-key walks. That is log2(32) = 5 bits.

Compare a random 6-character lowercase string: 6 × log2(26) = 28.20 bits. The walk has 6 characters, but because it is one of 32 possible walks rather than one of 308,915,776 possible strings, an attacker who tries walks first finds it within 32 guesses. Even generous counts that include diagonals, turns and shifted forms add only a few more bits, because the number of shapes people actually use is small.

For a 10-character walk the count is smaller still: only the two 10-key rows can hold one, so there are 2 × 2 = 4 straight walks. The longer the walk, the fewer of them there are.

Letter substitutions

Substitutions take a word and replace some letters with symbols or digits that look similar. The common ones are well known: a → @ or 4, e → 3, i → 1 or !, o → 0, s → $ or 5, t → 7. Guessing tools apply these as rules to every word in a list, along with capitalizing the first letter and adding digits or a symbol at the end.

Worked example: P@ssw0rd

Start with password, entry number one on the common list. Count every version an attacker might generate by allowing, for each letter, its lowercase form, its capital, and its common look-alikes:

Variants: 2 × 4 × 4 × 4 × 2 × 3 × 2 × 2 = 3,072, which is log2(3,072) = 11.58 bits.

So P@ssw0rd is one of 3,072 spellings of the most common password in the list. Even an attacker who tried every variant of every one of the 10,000 listed words in this way (a generous assumption, since most words have fewer swappable letters) would have about 30.7 million candidates, roughly log2(10,000) + 11.58 = 24.87 bits.

Measured naively, as 8 characters from all 94 printable characters, P@ssw0rd would look like 52.44 bits. The real figure is less than half of that, and in practice it is lower still, because attackers try the most popular substitutions first.

On the site’s illustrative rates (assumptions for scale, not measurements), checking all 30.7 million candidates takes about 0.0003 seconds against a fast unsalted hash, and on average about 26 minutes against a slow bcrypt-class hash. Online, the rate limit is what protects it, not the symbols.

Why rules make this worse

Composition rules (“must contain a digit, a capital and a symbol”) push people straight toward these habits. NIST SP 800-63B-4 explains that a user who would have chosen password “would be relatively likely to choose ‘Password1’ if required to include an uppercase letter and a number or ‘Password1!’ if a symbol is also required.” That is why NIST now says services “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types).” The full story is in password rules that backfire.

How the checker handles them

This site’s strength checker looks for keyboard walks, repeats and sequences, and it undoes common letter-for-symbol swaps and capitals before comparing a password with the bundled common list. When it finds one of these patterns, it charges the pattern’s small cost instead of full per-character cost, and shows that line so you can see why. It is an approximation, and its rules are simpler than a determined attacker’s, so treat a low score as reliable and a high score as an upper bound. More on that in how strength meters work.

Note: A symbol adds strength only when its position and identity are unpredictable. A random symbol in a random password does add bits; an @ that replaces an a adds almost none.

Summary

• Keyboard walks are short lists of shapes. Six keys in a straight row is one of only 32 options, about 5 bits.
• Substitutions such as @ for a are rules applied automatically; all 3,072 variants of password cost about 11.6 bits.
• Neither makes a predictable base unpredictable.
• Randomly generated characters or words give strength you can count; patterns give strength you can only hope for.

General explanation, not advice for a particular situation. Updated 2026-10-31.