Proposed new password metric: typability

It’s pass­word renewal time at work, and it’s got me think­ing about the best pos­si­ble pass­word. All the tips, tricks, lit­er­a­ture, guide­lines, rules, and auto­matic gen­er­a­tors are obsessed with cre­at­ing strong pass­words. And that’s fine, I gave up easy-to-remember pass­words a long time ago. But there’s another char­ac­ter­is­tics of a good pass­word that nobody has yet addressed.

How easy is a pass­word to type? How many times do you have to hold shift down? What about on your iPhone? How many times do you have to flip back and forth from one key lay­out to another? One pass­word I have makes me flip no less than five dif­fer­ent times.

That’s a pain in the ass.

I’d like to see this become a new met­ric in pass­word gen­er­a­tion. Let’s call it “typability.”

Here are three exam­ples of 8 char­ac­ter pass­words, rated “Strong 100%” at some Google-found pass­word checker site.

1.)%i}‘4[V

OMG. The gen­er­a­tor I used for that one sug­gested you “remem­ber” it this way, ”) % ipod } ’ 4 [ VIRGIN” to which I can only say… no. Plus, talk about hard to type. On a key­board, that takes three trips to the Shift key, so five lay­out changes, or to put it sim­ply, this 8 char­ac­ter pass­word takes 11 key­strokes. On the iPhone, it takes 17 taps (!), shift­ing vir­tual key­pads eight times! Talk about awful.

2.QW34+)(p

I came up with this one myself, mov­ing roughly left to right on the key­board, try­ing to stick with the shift key. On the key­board it takes two vis­its to the shift key, so only three lay­out changes, and 10 key­strokes. But because the keys are close to each other, they are eas­ier to type quickly. Does that make the pass­word eas­ier to crack? Pos­si­bly, but I don’t really know. On the iPhone key­board, it takes 14 taps, shift­ing the key­pad four times. Mar­gin­ally bet­ter than the above. I’d remem­ber this one as “Qwerty p”.

3.aS1$&:9′

I came up with this one, too, but on the iPhone. On a phys­i­cal key­board, it takes two shift key strokes, and 10 key­strokes, which is the same as the above (though it seems faster to me). But on the iPhone it takes only 10 taps, shift­ing the key­board only once. Of course, I’d have to remem­ber it as “assy sand ought nine uh” so that’s prob­a­bly a problem.

So, I’m look­ing for a strong pass­word gen­er­a­tor that can also pro­duce pass­words that are easy to type on a key­board, an iPhone key­board, other key­boards (though I don’t per­son­ally care about them), and has mnemonic/memorable clues. I am curi­ous about whether typa­bil­ity com­pro­mises pass­word strength, too.

Any­one up for that? Lazyweb?