Passwords and Entropy
Attackers rarely type guesses by hand; software tries billions of candidates. The strength of a password is about how many guesses it takes, which depends on how long it is and how big the set of possible characters is.
If each character can be one of pool symbols, a random password of length characters has pool ** length possibilities. We express this in bits of entropy: length * log2(pool). Every extra bit doubles the guesses. A pool of lowercase letters is 26, add digits for 36, add capitals for 62.
Two truths: length beats complexity, and entropy only counts when the password is truly random. P@ssw0rd! looks complex but sits in every cracking list. A long random passphrase from a password manager wins.
Which is generally stronger if both are random?
A password has 12 characters from a pool of 62 (upper, lower, digits). Print its entropy in bits rounded to 1 decimal.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.