Password Entropy (Uniform Random Generation)

Entropy describes how a secret was generated, not how it looks. That sentence is the whole page, and everything below is a consequence of it. $H = L\log_2 b$ is exact for a password produced by drawing $L$ symbols uniformly at random from a stated alphabet of $b$, and it is meaningless for a password a human chose. There is no function of the characters of a string that returns its entropy, because the entropy is a property of the process that produced the string. Two passwords can be character-for-character identical and carry completely different strength depending on whether dice or a person picked them.

Randall Munroe made the point better than any explanation in xkcd 936, and the arithmetic is worth reproducing even though the comic itself is CC BY-NC and so is described here rather than shown. Take Tr0ub4dor&3. Eleven characters, four character classes, and it satisfies every composition rule ever written. But it was built: an uncommon base word (worth about 16 bits, because there are only so many uncommon words), one capitalisation choice (1 bit, since almost everyone capitalises the first letter), the common letter-to-digit substitutions (about 3 bits, because everyone makes the same ones), and a numeral and punctuation mark on the end (about 4 bits each). Twenty-eight bits, and every one of those steps is a step an attacker's rule set already knows. Now take four words drawn at random from a list of about 2048: $4 \times 11 = 44$ bits. The second is 65,000 times harder and vastly easier to remember, and it is longer, and it looks less "secure" to every password-strength meter ever deployed.

This page will not accept your password, and that is deliberate. It takes a length and an alphabet size, both of them counts, and there is nowhere to type a secret. Two reasons. The first is arithmetic: as above, there is nothing useful a calculator could do with the characters, so the field would be theatre. The second is that every tool currently ranking for "how strong is my password" invites the reader to paste a live credential into a stranger's web form, where it may be logged, cached by a proxy, or simply typed into the wrong box on the wrong day. Declining to offer the field is the correct engineering decision, and it costs nothing, because the honest calculation never needed the password.

Some landmarks for the numbers this page returns. Each character is worth $\log_2 b$ bits: 3.32 for digits, 4.70 for lower-case letters, 5.95 for the 62 alphanumerics, 6.57 for the 95 printable ASCII characters. So a twelve-character random alphanumeric password is 71 bits and the same length over all printable characters is 79. NIST SP 800-57 Part 1 Rev. 5 sets 112 bits as the minimum security strength for protecting data past 2030, with 128 bits the ordinary modern choice — figures that a password alone rarely reaches, which is why key stretching and rate limiting exist.

Two smaller cautions. Entropy is additive only over independent choices: appending your birth year to a random password adds far less than $\log_2$ of the number of years, because the attacker's rule set tries years first. And a password manager's generator is the right tool here precisely because it is boring — it draws uniformly, it does not get bored of long strings, and its output has exactly the entropy this equation claims.