Your password is "validated" when created. Validation means checking if it contains (it has to to validate): * a alpha character in it * a numeric character in it * a special character in it * (maybe more, this list is from memory) This means if you want to brute force such a password you do not need to check any password that does not follow the above mentioned rules. This makes the search space smaller and the cracking of the password faster.