Part of the Personal computing glossary:

Password entropy is a measurement of how unpredictable a password is.

Password entropy is based on the character set used (which is expansible by using lowercase, uppercase, numbers as well as symbols) as well as password length. Password entropy predicts how difficult a given password would be to crack through guessing, brute force cracking, dictionary attacks or other common methods.

Password entropy is usually expressed in terms of bits: A password that is already known has zero bits of entropy; one that would be guessed on the first attempt half the time would have 1 bit of entropy. A password's entropy can be calculated by finding the entropy per character, which is a log base 2 of the number of characters in the character set used, multiplied by the number of characters
in the password itself.

NIST provides the following guidelines for user-selected passwords with 30 bits of entropy:

  • Use a minimum of 8 characters selected from  a 94-character set.
  • Include at least one upper case letter, one lower case letter, one number and one special character.
  • Use a dictionary of common words that users should avoid, like a password blacklist.
  • Don’t use any permutations of your username as your password.

Of course password entropy can't be the only thing considered or passwords would be too long, complex and unmemorable. Best practices involve employing something memorable to the user but not easily guessed by anyone else. Because password length is one of the most important factors affecting password entropy and overall strength, a longer password can be simpler than a shorter one and still be effective.

See also: password strength meter

This was last updated in January 2014
Contributor(s): Matthew Haughn
Posted by: Margaret Rouse

Related Terms

Definitions

  • BIOS (basic input/output system)

    - BIOS (basic input/output system) is the program a personal computer's microprocessor uses to get the computer system started after you turn it on. It also manages data flow between the computer's o... (WhatIs.com)

  • Facebook

    - Facebook is a popular free social networking website that allows registered users to create profiles, upload photos and video, send messages and keep in touch with friends, family and colleagues. (WhatIs.com)

  • LISA

    - LISA (Local Integrated System Architecture) was Apple's first personal computer and GUI -based operating system. When it was released in 1983, the LISA OS was heralded by BYTE as "the most importan... (WhatIs.com)

Glossaries

  • Personal computing

    - Terms related to personal computers, including definitions about computers sold as consumer products and words and phrases about laptops, tablets and smartphones.

  • Internet applications

    - This WhatIs.com glossary contains terms related to Internet applications, including definitions about Software as a Service (SaaS) delivery models and words and phrases about web sites, e-commerce ...

Ask a Question. Find an Answer.Powered by ITKnowledgeExchange.com

Ask An IT Question

Get answers from your peers on your most technical challenges

Ask Question

Tech TalkComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.