Password strength and generation

Strength is entropy, the number of guesses an attacker needs

02-05 showed that a composition rule can accept Password123! and reject a genuinely random string, because compliance with a rule is not the same property as actual unpredictability. This page gives the measure that rule fails to track. A password’s strength is not how it looks; it is how many guesses an attacker needs on average before one matches, and that follows from two facts: how many different characters could go in each position, and how many positions there are.

The lecture reduces this to two formulas. First, the total number of possible passwords for a character set of size $C$ and a length of $L$ characters, $N = C^L$. Second, the entropy in bits that this count represents, $H = \log_2 N = L \log_2 C$. $N$ answers “how many passwords exist.” $H$ answers “how much uncertainty does an attacker face,” and it is $H$, not $N$, that the lecture calls a password’s strength.

Formula

Password combinatorics and entropy

$$N = C^L, \qquad H = \log_2 N = L \log_2 C$$

$N$

total number of possible passwords

$H$

entropy in bits

$C$

size of the character set

$L$

password length in characters

Try it — worked example

A password is 6 lowercase letters. Find the number of combinations N and the entropy H in bits.

Show answer and steps

AnswerN = 26^6 = 308,915,776; H ≈ 28.2 bits

1. Character set: lowercase letters only, $C = 26$. Length $L = 6$.
2. Combinations: $N = C^L = 26^6 = 308{,}915{,}776$.
3. Entropy: $H = \log_2 N = 6 \log_2 26$. $\log_2 26 \approx 4.7004$, so $H \approx 6 \times 4.7004 \approx 28.20$ bits.

Try it — worked example

A password is 8 characters from upper case, lower case, digits and 10 special characters. Find N and H.

Show answer and steps

AnswerN = 72^8 ≈ 7.22×10^14; H ≈ 49.36 bits

1. Character set: upper case + lower case + digits + 10 special characters, $C = 26 + 26 + 10 + 10 = 72$. Length $L = 8$.
2. Combinations: $N = C^L = 72^8 = 722{,}204{,}136{,}308{,}736 \approx 7.22 \times 10^{14}$.
3. Entropy: $H = \log_2 N = 8 \log_2 72$. $\log_2 72 \approx 6.1699$, so $H \approx 8 \times 6.1699 \approx 49.36$ bits.

Try it — worked example

Same 72-character set, but length 12. Find N and H.

Show answer and steps

AnswerN ≈ 1.94×10^22 (the lecture prints ≈3.7×10^22, a source defect); H ≈ 74.1 bits, correct as printed

1. Same 72-character set, $C = 72$, length $L = 12$.
2. Split the exponent in half to keep the numbers manageable: $72^6 = 139{,}314{,}069{,}504$.
3. $N = 72^{12} = (72^6)^2 \approx (1.393 \times 10^{11})^2 \approx 1.94 \times 10^{22}$.
4. Entropy: $H = \log_2 N = 12 \log_2 72 \approx 12 \times 6.1699 \approx 74.04$ bits, matching the lecture’s own printed $\approx 74.1$ bits.

Try it — worked example

An attacker guesses 10^9 passwords per second. How long, on average, to crack the 26^6 password and the 72^12 password?

Show answer and steps

Answer26^6 password: under a second. 72^12 password (corrected N): roughly 300,000 years, both at 10^9 guesses/second.

Use the average case from the two entropy examples above: an attacker expects to find the password after searching half the keyspace, not all of it.

1. Weak case (first example): $N = 308{,}915{,}776$. Average guesses $= N / 2 = 154{,}457{,}888$.
2. At $10^9$ guesses per second, a fast offline hash cracked on a GPU: $154{,}457{,}888 / 10^9 \approx 0.15$ seconds.
3. Strong case (corrected 72^12 example): $N \approx 1.94 \times 10^{22}$. Average guesses $\approx 9.7 \times 10^{21}$.
4. At the same rate: $9.7 \times 10^{21} / 10^9 = 9.7 \times 10^{12}$ seconds.
5. Converting to years, at $\approx 3.156 \times 10^7$ seconds per year: $9.7 \times 10^{12} / 3.156 \times 10^7 \approx 3.1 \times 10^5$, roughly 300,000 years.

Pitfall

$N$ and $H$ answer different questions. $N$ is how many passwords exist; $H = \log_2 N$ is how many bits of uncertainty that represents, and it is $H$ that the lecture and this site call “entropy” or “strength.” A question asking for entropy wants a number in the twenties to eighties, not a twenty-two-digit combinatorial count. Writing $N$ when $H$ was asked loses marks even when every digit of $N$ is correct.

An attacker holding a stolen password list, hashed and salted or otherwise, does not start with brute force. The lecture’s reasoning is cost: trying every combination is expensive, so attackers run a dictionary attack first, checking the list against known words, previously breached passwords and common substitutions, before falling back to exhausting the full character set. Either attack, given enough time at a high enough guess rate, eventually finds a low-entropy password. This is the storage side of the disclosure concern in 02-05; entropy decides whether “eventually” means seconds or millennia. At roughly 74 to 78 bits, even an offline cracking cluster is looking at hundreds of thousands of years on average, not a workable attack.

Password entropy calculator

Estimate the strength of a charset-based password or a diceware-style passphrase: bits of entropy, total combinations, and mean time to guess.

Charset + lengthWordlist + words

Character setDigits (0-9)Lowercase lettersLowercase + digitsUpper + lower + digitsAll printable ASCII

Length

Guess rate10/s — throttled online login10,000/s — unthrottled online10⁹/s — offline, fast hash, GPU10¹²/s — offline clusterCustom

Four methods reach high entropy without memorising random characters

Length and unpredictability are exactly what human memory is bad at holding, the same tension 02-05 names. The lecture gives four tried methods for reaching enough entropy while keeping the result recoverable from memory: password managers, the dice method, letters-from-a-sentence, and PAO.

Password managers. A password manager stores every password behind one strong master password, generates long, high-entropy strings on request, and typically integrates with the browser to fill them in. Apple Keychain, the built-in browser managers, Bitwarden and LastPass are the lecture’s named examples. Because the manager, not the user, chooses the string, entropy is no longer limited by what a person can memorise. The lecture names four real drawbacks: losing the master password loses every stored password at once; mobile support and cross-device sync remain uneven, though better than before; opening the manager makes for a longer login workflow; and some sites block pasting into a password field, which the lecture calls a bad idea outright, not a legitimate security measure.

Dice method. Roll five standard six-sided dice and record the result as a five-digit sequence, each digit 1-6. Look that sequence up in a word list built so every possible five-roll sequence maps to exactly one word, the EFF’s Long Wordlist in the lecture’s example. Repeat for as many words as the passphrase needs, and string them together. The lecture’s worked example, thirty rolls: 54452 61644 63545 53161 42142 looks up as sizable tapioca undoing scalded nemesis. Turning the words into a sentence (“The sizable bowl of tapioca pudding was undoing my patience…”) makes the sequence easier to hold, since people remember sentences better than word lists, and word lists better than digit strings. The wordlist has to contain exactly $6^5 = 7{,}776$ words so the mapping covers every possible roll sequence with no gaps and no collisions. Today’s recommended passphrase length is six words. The method’s one acknowledged drawback is typing cost: six dictionary words is a lot more keystrokes than a twelve-character mixed-case string.

For a passphrase of $n$ words from a list of $W$ words, the entropy is $H = n \log_2 W$.

Try it — worked example

A passphrase is 6 words picked by dice from the EFF long list (7,776 words). Find the number of combinations and the entropy.

Show answer and steps

Answer7,776^6 ≈ 2.2107×10^23 combinations; H ≈ 77.55 bits

1. Wordlist size $W = 7{,}776 = 6^5$ (the EFF long list, one word per five-die roll). Word count $n = 6$, today’s recommended length.
2. Total combinations: $N = W^n = 7{,}776^6 \approx 2.2107 \times 10^{23}$.
3. Per-word entropy: $\log_2(7{,}776) = \log_2(6^5) = 5 \times \log_2 6 = 5 \times 2.58496 \approx 12.9248$ bits.
4. Total entropy: $H = n \times \log_2 W = 6 \times 12.9248 \approx 77.55$ bits.

Letters-from-a-sentence. Pick a memorable sentence and take one or two letters from each word. The lecture’s example: Wow! 62 students, all in this memorable class of 2026! becomes W!62s,aitmc02o26!. The method tends to produce upper case, lower case, digits and special characters without the user inventing any of them separately. It also extends cleanly: taking a second letter per word lengthens the password while the sentence stays the same size in memory.

Person-Action-Object (PAO). Choose a person and a place, then invent a random action linking them to an object. The stranger the scenario, the more memorable the image. The lecture’s example: Darth Vader riding a pony on Mt Everest. Apply a fixed rule to turn the scenario into characters: first two letters of each word gives DVrapoMtE!, and substituting characters for sounds extends it to DVr4poMt3!. The rule has to stay fixed and be applied consistently, or the method loses the one thing that makes it faster to recall than a random password: a repeatable procedure standing in for memorised characters.

Passkeys never send a secret, so there is nothing to phish or breach

Passkeys remove the password from the exchange entirely. What moves between the device and the site is a cryptographic key pair and a signed challenge, not something an attacker who intercepts or steals it could reuse to log in as the user.

Registration. The user starts registration on the site, which the lecture calls the relying party. The relying party generates a random challenge and sends it to the user’s device. The user verifies locally, by fingerprint, face or PIN. Once that succeeds, the device (the authenticator) generates a fresh public-private key pair. The private key never leaves the device: it stays in a secure enclave or TPM. The public key, together with the signed challenge, goes to the relying party, which stores the public key for future logins.

Verification. Login starts the same way: the user initiates it, and the relying party issues a new challenge. The user verifies locally again. The device signs the new challenge with the private key it already holds, and sends the signature back. The relying party checks the signature against the public key it stored at registration; a match authenticates the user. No password, and no shared secret of any kind, is transmitted.

Compare

Password authentication

A password is a shared secret. The server stores something derived from it, ideally hashed and salted, and the same string is retyped and sent at every login. A breach of that stored list, or a phished or intercepted entry, hands the attacker something they can try to crack or reuse directly.

Passkey authentication

The private key never leaves the device. The server stores only a public key, which cannot sign a login on its own. Every login is a fresh challenge the device signs, never a secret sent over the wire, so a server-side breach yields public keys an attacker cannot authenticate with.

Recall

A password manager generates a 20-character random string from the full 95-character printable ASCII set. Using H = L x log2(C), roughly how many bits of entropy is that, and how does it compare to the corrected 72^12 example and the six-word dice passphrase above?

$H = 20 \times \log_2 95 \approx 20 \times 6.57 \approx 131$ bits. That clears both the corrected 72^12 figure (≈74 bits) and the six-word dice passphrase (≈77.55 bits) by a wide margin, without asking anyone to remember a single character of it.