Part of the Personal computing glossary:

Password entropy is a measurement of how unpredictable a password is.

Password entropy is based on the character set used (which is expansible by using lowercase, uppercase, numbers as well as symbols) as well as password length. Password entropy predicts how difficult a given password would be to crack through guessing, brute force cracking, dictionary attacks or other common methods.

Password entropy is usually expressed in terms of bits: A password that is already known has zero bits of entropy; one that would be guessed on the first attempt half the time would have 1 bit of entropy. A password's entropy can be calculated by finding the entropy per character, which is a log base 2 of the number of characters in the character set used, multiplied by the number of characters
in the password itself.

NIST provides the following guidelines for user-selected passwords with 30 bits of entropy:

  • Use a minimum of 8 characters selected from  a 94-character set.
  • Include at least one upper case letter, one lower case letter, one number and one special character.
  • Use a dictionary of common words that users should avoid, like a password blacklist.
  • Don’t use any permutations of your username as your password.

Of course password entropy can't be the only thing considered or passwords would be too long, complex and unmemorable. Best practices involve employing something memorable to the user but not easily guessed by anyone else. Because password length is one of the most important factors affecting password entropy and overall strength, a longer password can be simpler than a shorter one and still be effective.

See also: password strength meter

This was last updated in January 2014
Contributor(s): Matthew Haughn
Posted by: Margaret Rouse

Related Terms

Definitions

  • virtual assistant

    - A virtual assistant is an electronic audio or audio/video avatar-centered program that uses artificial intelligence to perform tasks for the user. Virtual assistants have existed in concept for yea... (WhatIs.com)

  • bring your own apps (BYOA)

    - Bring your own apps (BYOA) is the trend toward employee use of third-party applications and cloud services in the workplace. BYOA, like the BYOD trend towards user-owned devices in the workplace, i... (WhatIs.com)

  • search operator

    - A search operator (sometimes referred to as a search parameter) is a character or string of characters used in a search engine query to narrow the focus of the search. Search operators are usually ... (WhatIs.com)

Glossaries

  • Personal computing

    - Terms related to personal computers, including definitions about computers sold as consumer products and words and phrases about laptops, tablets and smartphones.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question. Find an Answer.Powered by ITKnowledgeExchange.com

Ask An IT Question

Get answers from your peers on your most technical challenges

Ask Question

Tech TalkComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.