Password Strength and Entropy: Why Length Beats Complexity
Understanding password entropy, brute-force time estimates, and why 16+ character passphrases win
Learn how password strength is measured through entropy bits, why longer passwords beat complex short ones, and how to create truly secure passphrases that resist cracking.
What You'll Learn
- •Password entropy formula explained
- •Charset size to bits conversion
- •Brute-force time estimation
- •Diceware passphrase method
- •Why length beats complexity
- •Character set entropy comparison
- •Password manager recommendations
- •Weak password pattern examples
Full Guide
The old advice—mix uppercase, lowercase, numbers, symbols—focused on character set size but ignored the most important factor: length. Password strength is measured in entropy bits, calculated as:
`entropy = log2(charset_size ^ length) = length × log2(charset_size)`
Character Set Impact (Bits Per Character)
- Lowercase only (26 chars): log2(26) ≈ 4.7 bits/char
- + uppercase (52 chars): log2(52) ≈ 5.7 bits/char
- + numbers (62 chars): log2(62) ≈ 5.95 bits/char
- + symbols (95 chars): log2(95) ≈ 6.6 bits/char
Cracking Time Comparison (10 billion guesses/second)
| Password | Time to Crack |
|---|---|
| 8 chars mixed | 2.2 days (too weak!) |
| 12 chars mixed | 75 years |
| 16 chars mixed | 10^23 years (> universe age) |
| 20-char passphrase | ~infinite |
The Diceware Approach
Choose random words from a 7776-word list. Each word adds ~12.9 bits of entropy (log2(7776)).
- 5-word passphrase: 64.5 bits
- 6-word passphrase: 77.4 bits
These are easier to remember and harder to crack than "P@ssw0rd!2024".
Common Weakness Patterns
- Predictable patterns: "Summer2024!" is weak despite 11 chars
- Leetspeak substitutions: "P@$$w0rd" is not much stronger than "Password"
- Personal info: pet names, birthdays, family names are in attacker wordlists
- Reused passwords: one breach compromises all accounts
Recommendation
Use a password manager (Bitwarden, 1Password, KeePass) with a unique 16+ character random password per site. Your master password should be a Diceware passphrase of 5-7 words.
Entropy Cheat Sheet
- 40 bits: Weak
- 60 bits: Decent
- 80 bits: Strong
- 100+ bits: Very strong