I'm coming up with a password to use for my banking website, XKCD style.

Furthermore, I'm considering adding in an emoticon (say, a <3)

How many bits of entropy does an emoticon add to my password?

  • emoticons are just letters, numbers, and special characters, only the particular arrangement makes them emoticons to our eyes ... – schroeder Feb 17 '16 at 4:47
  • @schroeder True, but in a similar fashion, words are just particular arrangements of characters. – Nathan Merrill Feb 17 '16 at 5:09
  • exactly - so there is little gained by using emoticons over truly random strings - the more you introduce patterns (words, emoticons, etc.) the more you reduce your entropy – schroeder Feb 17 '16 at 5:48
  • @schroeder except that emoticons are easier to remember than random symbols, which is why we use words in the first place. – Nathan Merrill Feb 17 '16 at 5:49
  • so, what do you want? entropy or a memorable password? – schroeder Feb 17 '16 at 5:52

You can only really calculate entropy assuming it's a randomly generated password, according to some scheme. So if you randomly take an emoticon from a list of about 256 emoticons (256 = 2^8) and flip a coin to add this to the beginning or end of your password (2=2^1 choices), that adds 9 bits of entropy. Remember, when things are chosen uniformly, entropy in bits is simply the base-2 logarithm of the number of possible choices.

Please note you should avoid using emoticons with non-ASCII letters in your passwords (emoticons like: ಠ_ಠ or :っ) ) as they'll often be difficult to type on different devices, may possibly be silently stripped out of the password (so add no extra strength) to avoid potential encoding and unicode equivalence issues.


From a brute-force approach that doesn't know anything about emoticons, it depends on the input character set. My keyboard has, if I've counted correctly, 68 printable characters you can type with either one key or shift and one key. So, <3 would provide 68**2, or 4624, choices.

But perhaps your attacker is doing a dictionary attack instead. In that case, it really depends on how large their dictionary is - assuming, of course, that it includes <3 as a "word".

  • Not sure how you got 68 printable characters. There are 26 character keys, 10 numbers, and 11 ASCII symbol keys (,./;'[]\-= plus backtick), (26+10+11=47) all of which can be shifted for 94 characters and there's also space (which can't be shifted). Hence 95 printable ASCII characters (though occasionally there's some discrepancy whether characters such as linebreaks or tabs should be counted as printable or not). – dr jimbob Feb 18 '16 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.