Password Security and Entropy

Entropy: what password strength actually measures

Password strength is not a colour on a meter. It is a number of bits, and it has a precise definition: the base-2 logarithm of the number of possible passwords an attacker would have to consider.

entropy (bits) = length x log2(size of character set)

So a random 12-character password from the full printable set has 12 × 6.55 = 78.6 bits of entropy.

How long cracking actually takes

Attack speed depends entirely on how the password was stored. This is the single most important variable and it is controlled by the service, not the user.

Seven orders of magnitude separate the top and bottom rows. Against SHA-256 at 100 billion guesses per second:

Two conclusions. Length dominates everything — each extra character multiplies the search space. And the practical threshold is around 75–80 bits, which means 12 random characters or a 6-word passphrase.

Generate either in the password generator, which shows the entropy calculation.

How passwords are really broken

Brute force is the least common method, because it is the least efficient. Real attacks exploit human predictability.

1. Credential stuffing. Attackers take username and password pairs from one breach and try them everywhere else. Because roughly two thirds of people reuse passwords, success rates of 0.1–2% across millions of attempts are extremely profitable. This is the number one cause of account takeover.
2. Dictionary and rule-based attacks. Cracking tools take wordlists and apply the substitutions humans actually make: capitalise the first letter, append a year, replace a with @, add an exclamation mark. P@ssw0rd2026! falls in milliseconds.
3. Phishing. No password strength helps if the user types it into a convincing fake page. This is why phishing-resistant factors matter more than password complexity.
4. Password spraying. Rather than many passwords against one account, try a handful of very common passwords against many accounts. This evades per-account lockouts entirely.
5. Keyloggers and infostealer malware. Strength is irrelevant when the plaintext is captured at the keyboard.

What NIST actually recommends

NIST Special Publication 800-63B, revised in 2024, overturned decades of received wisdom. The current guidance:

Do

• Require a minimum of 8 characters; allow at least 64.
• Accept all printable ASCII, spaces and Unicode.
• Check new passwords against lists of known-breached passwords and reject matches.
• Allow paste, so password managers work.
• Store with a salted, memory-hard function.
• Offer multi-factor authentication.

Do not

• Do not impose composition rules. Requiring an uppercase, a digit and a symbol produces Password1! across an entire organisation. It reduces real entropy by making choices predictable.
• Do not force periodic expiry. Rotation without evidence of compromise makes users pick weaker, incrementing passwords (Spring2026 → Summer2026). Change on evidence of compromise only.
• Do not use password hints or security questions. Your mother’s maiden name is on the public record.
• Do not truncate. Silently cutting a password to 15 characters wastes the user’s effort and hides a bug.

Passphrases and the XKCD argument

The famous XKCD 936 comic argues that correct horse battery staple is both stronger and more memorable than Tr0ub4dor&3. The maths holds up, with one condition.

The condition is that the words must be chosen randomly, not by a human. The EFF publishes a 7,776-word list designed for dice selection, giving log2(7776) = 12.9 bits per word:

• 4 words = 51.7 bits — adequate with a slow hash, weak without
• 5 words = 64.6 bits — good
• 6 words = 77.5 bits — strong, the recommended default
• 7 words = 90.4 bits — strong enough for a master password

A phrase you invent yourself has far less entropy than the word count suggests, because human word choice is heavily biased and grammatical structure constrains what follows what. Song lyrics and quotations have effectively zero entropy — they are in the wordlists.

Passphrases are the right choice for the handful of passwords you must type from memory: your device login, your password manager master password, your disk encryption key. Everything else should be a long random string you never see.

Password managers, MFA and passkeys

Use a password manager

It is the single highest-impact change available. It generates unique high-entropy passwords for every site, eliminating credential stuffing entirely, and it refuses to autofill on a phishing domain — a phishing defence humans do not have.

Bitwarden, 1Password, KeePassXC and the browser-integrated managers are all credible. The only genuinely wrong answer is reusing passwords.

Multi-factor authentication, in order of strength

1. Hardware security keys (FIDO2/WebAuthn). Phishing-resistant by design: the key checks the origin cryptographically and will not respond to a lookalike domain.
2. Passkeys. The same WebAuthn cryptography with the private key held by your device or password manager. No shared secret exists to steal, and there is nothing to phish.
3. Authenticator apps (TOTP). Good, but the six-digit code can be relayed by a real-time phishing proxy.
4. SMS codes. Better than nothing. Vulnerable to SIM swapping and to SS7 interception, and NIST has discouraged it since 2016.

Passkeys are the direction of travel

A passkey is a key pair: the private key never leaves your device, the public key goes to the site. There is no shared secret to breach, no password to reuse, and no code to phish. Apple, Google and Microsoft all shipped support in 2022–2023 and adoption is now widespread. Where a site offers passkeys, use them.

Practical checklist

For individuals

• Install a password manager and let it generate everything.
• Use a 6-word passphrase for the master password.
• Turn on MFA everywhere, preferring passkeys or a hardware key.
• Check your addresses on Have I Been Pwned and change anything that appears.
• Never reuse a password, ever, on any site.

For developers

• Hash with Argon2id at 64 MB memory, 3 iterations, parallelism 4.
• Never invent your own hashing scheme.
• Check new passwords against a breached-password list.
• Rate-limit login attempts by IP and by account.
• Use constant-time comparison for tokens and signatures.
• Support WebAuthn and passkeys.
• Never log passwords, even at debug level, and never email them.
• Return an identical error for “unknown user” and “wrong password” so the endpoint does not enumerate accounts.

Frequently Asked Questions