Understanding Password Entropy
Entropy is the scientific measure of unpredictability or randomness in a password. In cryptography, we measure this in bits.
The Math
The formula for entropy is: E = L * log2(R)
- L = Length of the password.
- R = Pool size (number of possible characters).
Example: The 8-Character Password
If you use 8 characters, using uppercase, lowercase, numbers, and symbols (pool size ~94):
E = 8 * log2(94) = 8 * 6.55 = 52.4 bits
Modern cracking rigs can test billions of combinations per second. 52 bits can be exhausted in hours or days.
Why Length Beats Complexity
If you increase the length to 16 characters but only use lowercase letters (pool size 26):
E = 16 * log2(26) = 16 * 4.7 = 75.2 bits
Despite being "simpler" (no numbers or symbols), it is mathematically much harder to brute-force than the short complex password.
Common Mistakes
- Assuming Complexity is King: Forcing employees to use !@#$ symbols but allowing 8 character limits actively damages security.