Videos
How much entropy does my password have?
To find out how much entropy a password contains, follow these steps:
-
Determine the length of your password — how many characters there are.
-
Calculate the size of the pool of symbols from which you've taken the characters. For instance, if you only use lowercase letters, the pool size is 26. If you additionally use some digits, the pool size is already 36.
-
Compute the entropy as password its length times the log of the pool size to base 2.
How many bits of entropy for a good password?
For non-vital accounts, 25-30 bits of entropy are enough. For more important accounts, aim for 60-80 bits of entropy, up to 100 for crucial ones.
How to calculate password strength?
Password strength is quantified by password entropy, which is the log of the number of trials an adversary would have to make in order to guess your password.
measure of the effectiveness of a password in resisting guessing and brute-force attacks
I am currently helping in reviewing the company's password policy and looking at the shopping list of mandatory characteristics for building strong passwords, I got to thinking:
Why is it a standard practice to do qualitative rating of passwords based on it having a whole bunch of different criteria met instead of using a more quantitative rating based on it's entropy?
I get that one is easier for the user to achieve than the other, but a password manager can easily calculate the entropy of the passwords it stores (though few actually do so).
I have even seen recommendations for using mnemonics to remember passwords where the mnemonic would make for a stronger password than the actual password that it serves to remember. But since it doesn't have funky characters it doesn't pass muster.