How to Create Strong Passwords: The Science of Entropy

The Reality of Modern Password Cracking

Many users still create passwords by substituting letters with symbols (e.g., replacing 'E' with '3' or 'A' with '@') and appending an exclamation mark. To human memory this feels clever, but to modern password-cracking software like Hashcat or John the Ripper running on GPU arrays, these rule-based permutations are tested within milliseconds.

A single dedicated modern cracking rig equipped with high-end GPUs can compute over 100 billion NTLM or SHA-1 hashes every single second. Under this level of computing throughput, character complexity rules provide far less security than sheer password length.

Understanding Information Entropy

Password entropy is the measure of uncertainty or randomness in a password, expressed in bits. It is calculated using the formula:

E = L × log2(R)

Where:

• L is the number of characters in the password (length).
• R is the size of the character pool (character set).

For example, a password of 8 characters choosing from lowercase letters and numbers (pool size 36) has:

8 × log2(36) ≈ 41.4 bits of entropy (crackable in hours)

Increasing the length to 20 characters from the same pool produces:

20 × log2(36) ≈ 103.4 bits of entropy (takes millions of years to crack)

Why Length Trumps Complexity

Notice that doubling the character set only adds a small fraction to entropy, whereas doubling the password length multiplies entropy directly. A 16-character random lowercase password is substantially more resilient against brute-force attacks than an 8-character password featuring uppercase letters, numbers, and symbols.

The Passphrase Approach (Diceware)

For master passwords that must be memorized, the Diceware method or random word passphrases (e.g., correct-horse-battery-staple) offer high entropy combined with human memorability. By selecting four to six random words from a dictionary of 7,776 words, you achieve 50 to 75+ bits of entropy with a phrase that is easy to type and remember.

Core Rules for Digital Security

1. Never reuse passwords: Every website, service, and email account must have a unique password.
2. Use a Password Manager: Generate and store 20+ character random strings inside trusted password vaults like Bitwarden or 1Password.
3. Adopt Hardware 2FA / Passkeys: Whenever possible, upgrade to WebAuthn / FIDO2 security keys to neutralize phishing attacks completely.

Frequently Asked Questions About Passwords

Why do periodic password expiration policies do more harm than good?

Both NIST (Special Publication 800-63B) and Microsoft now advise against mandatory periodic password rotation (e.g., forcing users to change passwords every 90 days). When users are forced to change passwords frequently without an active breach, they predictably resort to predictable patterns: incrementing numbers (Spring2026! → Summer2026!) or selecting weaker variations that make accounts easier to crack.

Are password generators in browsers and password managers truly random?

Yes. Reputable password generators utilize operating system cryptographic pseudo-random number generators (such as /dev/urandom on Linux/macOS, BCryptGenRandom on Windows, or crypto.getRandomValues() in web browsers). These algorithms collect hardware entropy from thermal noise, keystroke timings, and interrupt requests, ensuring outputs cannot be mathematically predicted.

What are Passkeys and will they replace passwords?

Passkeys are built on the FIDO2 / WebAuthn open standards, replacing shared secrets with public-key cryptography. When creating a passkey, your device generates a private key secured by biometric authentication (Face ID, Touch ID, or PIN) that never leaves your device. Because websites only receive the public key and every authentication exchange is cryptographically bound to the domain, passkeys are mathematically immune to credential phishing attacks.