Mathematical Foundation of Password Entropy
In cybersecurity and information theory, password entropy is a quantitative measurement of uncertainty and unpredictability in a secret passphrase. Introduced by mathematician Claude Shannon in 1948, entropy evaluates how many binary decisions (bits) an automated attacker must resolve to guess the secret via brute-force enumeration.
The Shannon Entropy Equation
The standard formula for calculating password entropy with an assumed uniform random distribution is:
Entropy (bits) = Length × log₂(Character Pool Size)
Where:
- Length ($L$): Total number of characters in the passphrase.
- Character Pool Size ($R$): Total unique set of characters from which each position is drawn:
- Digits only (0-9): $R = 10$ ($3.32$ bits/char)
- Lowercase letters only (a-z): $R = 26$ ($4.70$ bits/char)
- Alphanumeric mixed (a-z, A-Z, 0-9): $R = 62$ ($5.95$ bits/char)
- Full ASCII printable character set (with symbols): $R = 94$ ($6.55$ bits/char)
Entropy Tiers & NIST SP 800-63B Standards
The National Institute of Standards and Technology (NIST) Special Publication 800-63B provides statutory digital identity guidelines for authentication security:
- Under 28 Bits (Very Weak): Solvable in milliseconds. Vulnerable to simple dictionary wordlists (e.g. RockYou) and consumer-grade laptops.
- 28 to 35 Bits (Weak): Vulnerable to low-budget online botnets and single-GPU desktop rigs within hours.
- 36 to 59 Bits (Moderate): Reasonable protection against throttled online brute-force portals with CAPTCHA and rate limits, but easily reversed if the database password hash is leaked.
- 60 to 127 Bits (Strong): Computationally secure against offline commercial GPU cracking clusters (Hashcat 8x RTX 4090 rigs). Suitable for institutional and personal banking.
- 128+ Bits (Cryptographically Sovereign): Unbreakable by known physics. Exceeds the thermodynamic energy capacity of planet Earth to brute-force enumerations.
Frequently Asked Questions
Does length beat complexity in password creation? +
Yes. Because entropy scales linearly with length ($L$) but logarithmically with character pool size ($log_2 R$), adding characters increases crack time exponentially. A 16-character passphrase using simple lowercase words has vastly more entropy than an 8-character password packed with complex symbols.
What is Grover's Algorithm and why does it affect quantum crack times? +
Grover's algorithm is a quantum search algorithm that provides a quadratic speedup for brute-force attacks against symmetric keys and passwords. It effectively halves the bit strength: a 128-bit entropy password provides 64 bits of post-quantum security. To ensure safety in the quantum computing era, passwords should target 128+ bits of entropy.
Does this tool transmit my password to any server? +
No. All calculations are executed locally inside your web browser's JavaScript V8 engine. You can disconnect your device from the internet or open Developer Tools Network tab to verify zero network requests are made.