# Strength Analysis of Real-Life Passwords Using Markov Models
## 6 Discussion
asses all other passwords. _Uniappass_preview_ is the best model built from a dataset that is completely missing a major group of characters. A helping factor for this is no doubt also the fact that the dataset was constructed for password cracking (although here we use only a part of it) and is not just a collection of random passwords. The four datasets that were the best have one thing in common. Frequency distributions of characters show that they all have reasonable amounts (enough for the Markov model to make connections between the majority of characters) of all types of characters. The most variety in the character set definitely belongs to the _rockyou_ dataset. This is the most likely reason that this dataset is the most reliable at being able to calculate the strength of any password. The _10_million_passwords_ dataset is similar to _rockyou_ in the distribution of characters, but it does not have such a wide range of characters. Consequently, it is better at measuring more common passwords (constructed from more commonly used characters), while it somewhat lags behind the _rockyou_ in the ability to calculate the strength of any password. Third (_phpbb_) and fourth (_tuscl_) best models were constructed from a lot smaller datasets and therefore cannot compare with the first two in the number of characters, but the amount of characters here is still enough for Markov models to not have problems building connections between them and from the frequency distributions of characters it is visible that proportions between different types of character are still very similar. The built Markov models are therefore probably also very similar, resulting in password strength estimation very much alike to those of _10_million_passwords_ and _rockyou_ even though they were built from considerably smaller datasets. _Hotmail_ and _singles_org_ datasets both have a good amount of lower-case letters and comparable, although a small, number of upper-case letters. _Hotmail_ also has proportionally more numeric characters and it has some special characters while _singles_org_ has none. As a result, _hotmail_ is better at calculating the password strength for any password and is also marginally better overall. _Hotmail_ model is in 6 th place, while _single_org_ is in 7 th. _10K_most_common_ is the 3 rd smallest dataset, but with the shortest average password length, it contains an even smaller amount of characters than the smallest dataset-_fithwriters_. It has no upper-case letters, practically no special characters and the proportion of numeric characters is small when compared to the best models. More than 83% of all passwords in _10K_most_common_ consist exclusively of lower-case letters. Frequency analysis of characters would suggest _fithwriters_ to be a better dataset because it contains upper-case letters and more numeric characters, however, the end results do not support this presumption. Contents of the two datasets reveal that _fithwrites_ has many passwords with religious motives (the dataset was obtained from a religious forum) consequently suffering from a large number of very similar passwords. A dataset consisting of related passwords creates a Markov model that is not good at estimating the strength of any other passwords. The _10K_most_common_ dataset on the other hand is a collection of common passwords. The dataset is filtered and does not contain recurrence of any passwords. Because it contains the most likely passwords it also contains at least some of the most likely combinations of letters. As a result, the _10K_most_common_ model is very successful despite its size and absence of upper-case letters. The _myspace_ dataset contains a varied collection of characters, but the special characters and the upper-case letters are sparse.