The Mathematics of Password Entropy
Password strength is measured in bits of entropy ($E$), quantifying how many combinations an attacker must test to exhaustively brute-force your password:
Step-by-Step Entropy Calculation Example
Suppose you generate a 16-character password using uppercase, lowercase, numbers, and symbols:
- Determine pool size ($R$): 26 + 26 + 10 + 32 =
94 possible characters. - Compute bits per character: log₂(94) = ln(94) / ln(2) ≈
6.5545 bits. - Multiply by password length ($L$): 16 × 6.5545 ≈ 104.87 bits of entropy.
- Brute force resilience: An attacker testing 100 billion combinations per second would require over 1.2 × 10¹⁴ years to exhaust the search space.
How Password Entropy Protects Your Accounts
Length Beats Complexity
A 16-character password with mixed characters requires trillions of centuries to crack with modern supercomputers. Length is the single most effective defense against brute force.
Cryptographic Randomness
UnitNov utilizes `crypto.getRandomValues()` instead of standard `Math.random()`. This ensures hardware-level entropy that cannot be predicted by algorithmic reverse engineering.
Never Reuse Passwords
Always generate a unique password for every account. If one service suffers a credential leak, your remaining banking, email, and social accounts stay protected.
Frequently Asked Questions
Common questions and detailed answers regarding calculations and formulas.