The Mathematics of Password Security: Shannon Entropy, NIST Guidelines & Cryptographic Randomness

The Illusion of "Complex" Passwords

For decades, IT administrators enforced strict password composition rules: at least 8 characters, at least one uppercase letter, one number, and one special symbol.

Human psychology quickly adapted by creating predictable patterns:

To modern brute-force hash-cracking clusters powered by GPUs (utilizing tools like Hashcat and John the Ripper), these pattern-based masks are tested within the first milliseconds of an attack.

Calculating Password Information Entropy

In information theory, Shannon Entropy measures the unpredictability or randomness of an information source. For passwords, entropy is expressed in bits:

Where:

Comparing Character Pool Sizes (R):

Entropy Comparison Matrix:
┌─────────────────────┬─────────┬────────┬──────────────┬─────────────────────────┐
│ Password            │ Length  │ Pool R │ Total Bits   │ Brute Force Resistance  │
├─────────────────────┼─────────┼────────┼──────────────┼─────────────────────────┤
│ "Secret1!"          │ 8 chars │ 94     │ 52.4 bits    │ Cracked in < 1 minute   │
│ "Tr0ub4dor&3"       │ 11 chars│ 94     │ 72.1 bits    │ Cracked in ~ 3 days     │
│ "correct-horse-..." │ 28 chars│ 26     │ 131.7 bits   │ Uncrackable (Billions y)│
│ "xK9#m$Q2!vL7@pW1"  │ 16 chars│ 94     │ 104.9 bits   │ Uncrackable (Centuries) │
└─────────────────────┴─────────┴────────┴──────────────┴─────────────────────────┘

NIST Special Publication 800-63B Recommendations

The US National Institute of Standards and Technology (NIST) overhauled modern password authentication recommendations:

True Cryptographic Randomness: Math.random() vs. CSPRNG

When generating passwords in web software, using JavaScript's standard Math.random() is a critical security vulnerability:

const buffer = new Uint32Array(length);
  window.crypto.getRandomValues(buffer);