2 ms·
It's ~1 bit per character for normal English text. If your password has weird stuff in it (weird words, non-grammar, weird characters) then it will be higher.
by Thorrez 7y ago
It's ~1 bit per character for normal English text. If your password has weird stuff in it (weird words, non-grammar, weird characters) then it will be higher.
Also, I'm not sure if the theoretical entropy levels are ever reached by real password crackers. I think they tend to use more basic rules. In that case I think zxcvbn might provide a better estimate (multiply guesses_log10 by 3.3 to get bits). But if your password contains a phrase that has ever been written publicly, the entropy massively decreases.
https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/
- bostik 7y agoI went with ~1b per character precisely because OP stated that they use a passphrase. A long phrase with semantic meaning will be easier to remember than a 50-character diceware output, after all. Now, admittedly for me a passphrase is something that could be identified and processed by NLP-like construction. (Hence it could be also produced by one.) A sequence of random words requires, at least in my case, to come up with a special mnemonic. As a sibling post points out, if the phrase is generated by diceware (iow. sequence of words chosen at random from a large dictionary), then the entropy would be way, way higher - so high in fact that bruteforcing might be eclipsed by heat death of the universe.