1337 3mk0d1n9 ("Elite Encoding", encoded) works because every user has their own variations and level of encoding (which can be consciously or unconsciously varied by the user). In addition, individual organisations and geographic areas will have their own encoding just as they have their own jargon. Some extreme examples for the (fresh) sight-generated password "ultrasparc":
- V17r4$p4rk
- (capital-victor) (numeral-one) (numeral-seven) (small-romeo) (numeral-four) (dollar sign) (small-papa) (numeral-four) (small-romeo) (small-kilo)
- U!+r@5q@r(
- (captial-uniform) (exclamation mark) (plus sign) (small-romeo) (at sign) (numeral-five) (small-quebec) (at sign) (small-romeo) (open parenthesis)
And for "microsystems":
- W!<r05x$t3w5
- (captial-whiskey) (exclamation mark) (<) (small-romeo) (numeral-zero) (numeral-five) (small-x-ray) (dollar sign) (small-tango) (numeral-three) (small-whiskey) (numeral-five)
- muSvs7#/\/\s
- (small-mike) (small-uniform)1 (captial-sierra) (small-victor) (small-sierra) (numeral-seven) (hash) (forward slash) (backslash) (forward slash) (blackslash) (small-sierra)
Some rules (in the form of regular expressions):
- Capitalise start of words
- s/u/v/ & s/v/u/
- (s/l/1/ or s/l/!/) or (s/i/1/ or s/i/!/)
- s/t/7/ or s/t/+/
- s/a/4/ or s/a/@/
- s/s/$/ or s/s/5/
- s/p/q/
- s/c/k/ or s/c/(/ or s/c/</
- s/m/w/ or s/m/n/ or s/m/\\/\\\\/\\/
- s/o/0/
- s/y/x/ or s/y/v/
- s/k/x/
- s/e/3/ or s/e/#/
- Break rules frequently!
Leet Encoding isn't necessarily harder to crack on a user-by-user basis using social guesses; unless a user is very foolish there are too many unencoded words to try. However it should significantly increase the time required for brute-force techniques on a single account or an entire password file.
If you enjoy mnemonics, passwords generated by this method can be much easier to remember than other password paradigms. Plus it's the one time you can use the Leet Alphabet without being embarassed. :) A major draw-back is the difficulty of pronouncing the password.
1: s/micro/mu/