Browse Definitions :
Definition

password entropy

Password entropy is a measurement of how unpredictable a password is.

Password entropy is based on the character set used (which is expansible by using lowercase, uppercase, numbers as well as symbols) as well as password length. Password entropy predicts how difficult a given password would be to crack through guessing, brute force cracking, dictionary attacks or other common methods.

Password entropy is usually expressed in terms of bits: A password that is already known has zero bits of entropy; one that would be guessed on the first attempt half the time would have 1 bit of entropy. A password's entropy can be calculated by finding the entropy per character, which is a log base 2 of the number of characters in the character set used, multiplied by the number of characters
in the password itself.

NIST provides the following guidelines for user-selected passwords with 30 bits of entropy:

  • Use a minimum of 8 characters selected from  a 94-character set.
  • Include at least one upper case letter, one lower case letter, one number and one special character.
  • Use a dictionary of common words that users should avoid, like a password blacklist.
  • Don’t use any permutations of your username as your password.

Of course password entropy can't be the only thing considered or passwords would be too long, complex and unmemorable. Best practices involve employing something memorable to the user but not easily guessed by anyone else. Because password length is one of the most important factors affecting password entropy and overall strength, a longer password can be simpler than a shorter one and still be effective.

See also: password strength meter

This was last updated in January 2014

Continue Reading About password entropy

SearchCompliance
  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

  • information governance

    Information governance is a holistic approach to managing corporate information by implementing processes, roles, controls and ...

SearchSecurity
  • threat modeling

    Threat modeling is a procedure for optimizing application, system or business process security by identifying objectives and ...

  • social engineering

    Social engineering is an attack vector that relies heavily on human interaction and often involves manipulating people into ...

  • distributed denial-of-service (DDoS) attack

    A distributed denial-of-service (DDoS) attack is one in which multiple compromised computer systems attack a target, such as a ...

SearchHealthIT
SearchDisasterRecovery
  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

  • risk mitigation

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

SearchStorage
  • storage security

    Storage security is the group of parameters and settings that make storage resources available to authorized users and trusted ...

  • cloud storage

    Cloud storage is a service model in which data is transmitted and stored on remote storage systems, where it is maintained, ...

  • cloud data management

    Cloud data management is a way to manage data across cloud platforms, either with or instead of on-premises storage.

Close