> 12 characters is only 72 bits of entropy ... That’s nowhere near enough entropy for a proper password. What do you base that on? If you assume the password

> 12 characters is only 72 bits of entropy ... That’s nowhere near enough entropy for a proper password. What do you base that on? If you assume the password is stored using current best practices (ie, you use a key definition function like PBKDF2 or even better scrypt), it's tons. You can't assume a website will be using anything reasonable - but anything I manually enter this 12 character password into, like a password manager a modern auth service, or ssh it is reasonable. Proof: assume you use a KDF that makes a check of a single password take at least 1ms on modern reasonable machine, 72 bits means it will take 149,642,763,799 (= 2^72 / 3600.0 / 1000.0 / 24 / 365.35) years to break. Sure you can parallelise it, so lets throw a billion of these "reasonable machines" at it. That reduces it to 149 years. I'll be well and truly six foot under before they crack it, which meets my definition of tons. But it's better to look at it from the point of view of the worth of the information they get versus expense. Let's say for argument's sake my entire net worth is $100M. Lets also also say a "reasonable machine" worth $10. And finally assume the value of that $100M shrinks over time, so after 20 years it's worth almost nothing. Continue assuming we use a KDF to ensure doing one guess takes 1 second, and you end up with needing 62 bits of entropy - or 11 characters.