Measuring Password Strength (Bits of Entropy)

How to measure password Strength ?

Being in the momentum of “the internet of things“ everyone has to have many online accounts nowadays. With all these accounts, users and applications are always in a race to protect their private data from piracy.

There are many techniques to protect data, but having a strong password is ultimately the best defense a user can have to protect their data online. This is, of course, with respect to other factors from the application side such as encryption, https, etc.

The strength of a password comes from a combination of length, complexity, and unpredictability. In order to measure the strength of passwords one has to calculate their bits of Entropy.

In Information Theory, entropy is the average amount of information contained in each message received (in this case, password) and is measured by bits. Here, message stands for an event, sample or character drawn from a distribution or data stream.

Entropy is the standard way to measure the strength of any password. Here is how we can get entropy of any password:

In order to find out the password entropy, we first have to look at two factors:

1- The max length of the password
2- Character set which represents the pool of characters the password can be made from.

We can use the above two factors to determine the number of all possible combinations of a particular password, which equals to:

$$(Character ^{Set Max Length}).$$

After getting the number of all possible combinations, we can calculate Entropy by applying the following formula:
$$Entropy = log_2 (Character ^{Set Max Length}).$$

For example, let’s say that a certain website allows users to create a password with a max length of 8 characters and it only allows alphanumeric characters.

In this case, the entropy can be calculated as the follow:

Character set = alphabets(a-z, A-Z) + numbers (0-9) = 26+26+10 = 62
Max Length = 8
Therefore

Password bist of Entropy = log2CSML = log2628 ≈ 47 bits

That’s it!!

the more bits of entropy the password has, the harder is to break.

How long does it take for a computer to guess a password?

It depends on how fast the computer is and how strong/weak the password is.

The chart below shows how many days it takes to break passwords from 0-50 bits of entropy. Note that passwords with 36.86 bits of entropy are considered strong.