Crypto math ·
The mathematics of passphrase entropy: why length defeats complexity
A password’s strength, if symbols are independent and uniformly random, is length times log2(charset size). Twelve random characters from a 90-symbol set beat P@ssw0rd1 because the latter is in every dictionary. Composition rules (one uppercase, one symbol) barely help human-chosen secrets. CSPRNG generation in the tab does help.
The formula and its assumptions
H = L * log2(N) for i.i.d. uniform symbols. Human passwords are not i.i.d. Strength meters that only check classes overstate.
NIST SP 800-63B
Length, blocklists, no arbitrary rotation. Composition rules are out. The generator still offers classes because some sites require them — that is compatibility, not math.
CSPRNG generation
getRandomValues, rejection sampling, charset checkboxes. Never Math.random. Never “email me a password.”
Diceware
Word lists are a charset of size equal to the list. Spaces between words count if the verifier keeps them. Local generation only.
Checkers versus generators
A strength checker should not send the password anywhere. Ours does not. zxcvbn-style local dictionaries are fine; cloud scoring is not.
Frequently asked questions
How many bits do I need?
Online guessing of a throttled login is a different threat than offline hash cracking. For offline, 80+ bits is a common floor; 128 is comfortable. UUIDs are 122 bits of ID space, not password policy.
Are word lists weaker than symbols?
Diceware with 6 words from a 7776-word list is about 77 bits if rolls are fair. That is often stronger than an 8-character mixed password a human invented.
Why rejection sampling?
Mapping random bytes with modulo bias slightly skews symbol frequencies. Rejection sampling removes the bias. See the Web Crypto article.