2 ms·

What does it mean? Users always pick low-entropy passwords?

• judge2020 8y ago
  Almost always. It's gotten better with the rise of password managers that generate random passwords, but otherwise, passwords are usually shared across many websites and usually less than 16 characters.
• rmc 8y ago
  Not "always". But you should not build your systems based on the assumption that passwords will be strong enough.