Password Strength Sheet

The numbers

ENTROPY (bits)

length x bits per character

Digits only (10)

3.32 bits each

Lowercase (26)

4.70 bits each

Letters + digits (62)

5.95 bits each

Letters, digits, symbols (95)

6.57 bits each

80 bits needs

13 symbol chars, or 18 lowercase

Sensible targets

80 ordinary · 128 long-lived

⚠ Only valid if RANDOM

a human-chosen password is worth far less

⚠ Attack rates span

~12 orders of magnitude — pick the threat

Passwords assessed

This password

Account

Date

Length

Alphabet

BITS OF ENTROPY

Attack rate assumed

POWERS OF TEN (years)

Chars needed for 80 bits

Chars needed for 128 bits

Generated randomly?

In a manager?

Action

Assessing a password honestly

• Generated by a machine — if not, the number is an upper bound only
• Length prioritised over adding symbols
• Attack scenario chosen to match the real threat, not the friendliest one
• A few decades treated as WEAK, not adequate — rates only rise
• 128 bits used for anything long-lived or protecting other credentials
• Reuse checked — strength is irrelevant if the password is shared across sites
• Two-factor enabled where available, which beats any amount of entropy
• Stored in a manager rather than remembered or written down

The assumption that carries everything

These figures describe a password chosen at random. A person's password is built from words, dates, names and predictable substitutions, and a cracker tries exactly those first — so 'P@ssw0rd123!' scores about 79 bits here and would fall almost at once to a wordlist with rules. The number is the most the password could be worth, not what it is worth.

Length beats complexity, and here is the size of it

Every extra character adds the same bits; changing the alphabet only changes how much each one adds. Moving from 62 characters to 95 adds 0.62 bits per character — under five bits across an eight-character password. Adding four more characters at the smaller alphabet adds nearly twenty-four.