Lessons · Cybersecurity · password entropy in bits
Password strength as a number of bits
Strength in bits is the length multiplied by the bits each character carries, and the bits per character come from the alphabet size: an alphabet of 2 to the power n gives n bits per character.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
Two policies both sound strict, and only the arithmetic says which is stronger. Bits let you compare a short password from a big alphabet with a long one from a small alphabet, and settle the argument in one line.
How to think about it
Find the alphabet size: how many different characters could appear in each position. Turn it into bits per character by asking what power of two it is (16 gives 4, 32 gives 5, 64 gives 6, 128 gives 7). Multiply by the length. Each extra bit doubles the number of guesses.
Worked example
bits = length * bits per characterThe one line.
An alphabet of 64 characters: 2 ** 6 = 64, so 6 bits eachLower case, upper case, digits and two symbols is about 64.
12 characters from that alphabet: 12 * 6 = 72 bitsSeventy-two bits, which is a very large number of guesses.
Add 2 characters: 14 * 6 = 84 bits, which is 4,096 times more guessesTwelve more bits, and each bit doubles.
Your turn
An alphabet of 32 characters. Write the number of bits each character carries.
bits per character =
Solve one, graded on the server
The trap
Counting the characters the person actually used instead of the alphabet the attacker must search. A ten-character password of lower-case letters is searched as 26 possibilities per position, whatever the policy allowed.