The Mathematics of Password Entropy
Password security is mathematically quantified in bits of entropy. Entropy measures the computational randomness and workload required for an attacker to brute-force a password through exhaustive search across all possible combinations.
The formula for password entropy is E = L × log₂(R), where L is the length of the password (number of characters) and R is the size of the character pool. For a password using lowercase letters (26), uppercase letters (26), digits (10), and symbols (32), the pool size is 94 characters. A 12-character password from this full pool yields approximately 78.8 bits of entropy — well within the "strong" classification.
The critical insight is that password length has a multiplicative effect on entropy while character pool size has a logarithmic effect. Doubling the password length doubles the entropy, but doubling the character pool only adds one bit. This is why a 20-character lowercase passphrase (like "correct-horse-battery") can be stronger than an 8-character complex password (like "P@s5w0rd") despite using a smaller character set.
- < 28 bits: Extremely weak — cracked in milliseconds by any automated tool.
- 28 - 35 bits: Weak — vulnerable to basic dictionary attacks and common password lists.
- 36 - 59 bits: Moderate — resistant to online brute-force but vulnerable to offline GPU cracking.
- 60 - 127 bits: Strong — suitable for enterprise authentication, resistant to current hardware.
- 128+ bits: Cryptographically secure — immune to brute-force even with theoretical future hardware.
TypeScript function calculating entropy bits with real-world examples.
export function calculatePasswordEntropy(password: string): number {
let poolSize = 0;
if (/[a-z]/.test(password)) poolSize += 26; // lowercase
if (/[A-Z]/.test(password)) poolSize += 26; // uppercase
if (/[0-9]/.test(password)) poolSize += 10; // digits
if (/[^a-zA-Z0-9]/.test(password)) poolSize += 32; // symbols
if (poolSize === 0 || password.length === 0) return 0;
return Math.round(password.length * Math.log2(poolSize));
}
// Examples:
// "password" → 37.6 bits (weak)
// "P@ssw0rd!" → 59.4 bits (moderate)
// "correct-horse" → 75.2 bits (strong)NIST SP 800-63B Modern Authentication Recommendations
The National Institute of Standards and Technology (NIST) published Special Publication 800-63B, which fundamentally changed password security best practices. Many traditional password policies — mandatory complexity rules, forced periodic rotation, security questions — were found to be counterproductive.
NIST's key recommendations include: Favour length over complexity. A minimum of 8 characters is required, but passphrases of 15+ characters are strongly encouraged. Do not impose arbitrary composition rules (e.g., "must contain uppercase, number, and symbol") as these lead to predictable patterns like "Password1!". Do not require periodic password changes unless there is evidence of compromise — forced rotation leads users to make minimal, predictable modifications. Screen passwords against known breach databases (like Have I Been Pwned) to reject commonly compromised credentials. Support paste functionality in password fields to encourage password manager usage.
These guidelines represent a shift from prescriptive complexity rules to evidence-based security, recognising that human behaviour is the weakest link. A memorable 25-character passphrase that a user can type reliably is far more secure than an 8-character random string they write on a sticky note.
Prefer long multi-word passphrases (e.g., 'correct-horse-battery-staple') over short complex passwords (e.g., 'P@ss123'). Length yields exponential entropy gains while remaining memorable.
Practice the concepts from this article using ToolZeno's browser-based developer tools. No sign-up, no server tracking — 100% client-side.
Hash Generator
FreeCompute MD5, SHA-1, SHA-256, and SHA-512 cryptographic checksums in-browser.
Password Generator
FreeGenerate highly secure, custom passwords in bulk with estimated entropy analysis and complexity metrics.
Password Strength Checker
FreeAnalyze password complexity, calculate entropy bits, detect repeating or sequential patterns, and estimate brute-force cracking times.
Why Raw SHA-256 Should Never Store Passwords
Cryptographic hash functions like SHA-256, SHA-512, and MD5 are designed for data integrity verification — computing checksums quickly to detect file corruption or tampering. A modern GPU can compute over 10 billion SHA-256 hashes per second. This speed, which is a feature for integrity verification, becomes a critical vulnerability when used for password storage.
If a database of SHA-256 hashed passwords is breached, an attacker can try every possible 8-character password (using the full 94-character pool) in under 3 hours using a single high-end GPU. Rainbow tables (pre-computed hash-to-password lookup tables) make this even faster for common passwords.
Password storage requires deliberately slow, memory-hard key derivation functions (KDFs). Argon2id (winner of the 2015 Password Hashing Competition) is the current gold standard. It accepts tuneable parameters for computation time, memory usage, and parallelism, allowing security teams to calibrate the cost of hashing to their hardware. Bcrypt remains a solid choice with widespread library support. PBKDF2 is acceptable for compliance-driven environments but is weaker against GPU attacks than Argon2.
All password KDFs incorporate a unique random salt per user. The salt ensures that identical passwords produce different hashes, defeating rainbow table attacks and preventing attackers from identifying users with the same password.
- SHA-256/SHA-512 are for data integrity, NOT password storage — they are orders of magnitude too fast.
- Argon2id is the recommended password KDF — tuneable for time cost, memory cost, and parallelism.
- Bcrypt with a work factor of 12+ remains a strong and widely supported alternative.
- Always generate a unique cryptographic random salt (16+ bytes) for each user's password hash.
- Never implement custom password hashing — use well-audited libraries like libsodium or bcryptjs.
Generating Secure Passwords & Keys in the Browser
Modern browsers provide the Web Cryptography API (crypto.getRandomValues), which generates cryptographically secure random numbers from the operating system's entropy pool. This means high-quality password and key generation can happen entirely client-side without relying on external APIs or server-generated randomness.
Client-side generation is particularly important for sensitive credentials. When you generate a password using an external web service, that service's server has momentary access to your credential. Even if the service claims not to log it, network monitoring, server-side caching, or access logs could capture it. Local generation in the browser eliminates this risk entirely.
ToolZeno's password generators use crypto.getRandomValues to produce passwords, passphrases, API keys, and cryptographic secrets with configurable entropy. The generated values never leave your browser tab, are never transmitted over the network, and are never stored in any server database.