Part of the Personal computing glossary:

Password entropy is a measurement of how unpredictable a password is.

Password entropy is based on the character set used (which is expansible by using lowercase, uppercase, numbers as well as symbols) as well as password length. Password entropy predicts how difficult a given password would be to crack through guessing, brute force cracking, dictionary attacks or other common methods.

Password entropy is usually expressed in terms of bits: A password that is already known has zero bits of entropy; one that would be guessed on the first attempt half the time would have 1 bit of entropy. A password's entropy can be calculated by finding the entropy per character, which is a log base 2 of the number of characters in the character set used, multiplied by the number of characters
in the password itself.

NIST provides the following guidelines for user-selected passwords with 30 bits of entropy:

  • Use a minimum of 8 characters selected from  a 94-character set.
  • Include at least one upper case letter, one lower case letter, one number and one special character.
  • Use a dictionary of common words that users should avoid, like a password blacklist.
  • Don’t use any permutations of your username as your password.

Of course password entropy can't be the only thing considered or passwords would be too long, complex and unmemorable. Best practices involve employing something memorable to the user but not easily guessed by anyone else. Because password length is one of the most important factors affecting password entropy and overall strength, a longer password can be simpler than a shorter one and still be effective.

See also: password strength meter

This was last updated in January 2014
Contributor(s): Matthew Haughn
Posted by: Margaret Rouse

Related Terms

Definitions

  • term boosting

    - Term boosting is the ability to assign higher importance to specific words in a search engine query. In Google, for example, advanced search options allow you to identify words that must be found i... (WhatIs.com)

  • Amazon

    - Amazon is the world’s largest online retailer. The company was originally a book seller but has expanded to sell a wide variety of consumer goods and digital media as well as its own electronic dev... (WhatIs.com)

  • iPad Air

    - Apple’s iPad Air is an iOS tablet that is lighter and thinner than the company’s previous tablets. (SearchConsumerization.com)

Glossaries

  • Personal computing

    - Terms related to personal computers, including definitions about computers sold as consumer products and words and phrases about laptops, tablets and smartphones.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question. Find an Answer.Powered by ITKnowledgeExchange.com

Ask An IT Question

Get answers from your peers on your most technical challenges

Ask Question

Tech TalkComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.