1

I want to use zxcvbn-c but it gives the entropy number, not score like the javascript library does. How do I convert entropy number to a score? (0 to 4)

The zxcvbn blog/source mentions that the score is related to estimated cracktime. I think this will be relative and increasing over time as computers get more powerful. But whats the current recomended formula to convert entropy to cracktime? How can I calculate a score for now? When should I reevaluate?

Heres what I found but how to know what guesses is made from and how to make the formula?

0 = guesses < 10^3
1 = guesses < 10^6
2 = guesses < 10^8
3 = guesses < 10^10
4 = guesses >= 10^10

IOW what are recomended entropy gradients for password strength nowadays?

3
  • Each bit of entropy doubles the expected number of guesses an attacker will have to make, so without looking into it further I would assume you could compare e < log2(10^n) where n is 3, 6, 8, 10, etc. Commented Feb 20, 2018 at 14:30
  • The app also give a "log10" number which is really just entropy * 0.301029996
    – TaTai
    Commented Feb 20, 2018 at 20:40
  • Then compare entropy log10 against 3, 6, 8, 10. Same thing either way. Commented Feb 20, 2018 at 20:55

1 Answer 1

0

Thanks @AndrolGenhald I think this is how the javascript works

log = e * 0.301029996;
if (log < 3) s = 0;
if (log < 6) s = 1;
if (log < 8) s = 2;
if (log < 10) s = 3;
if (log >= 10) s = 4;

Should someone have better indepth answer about entropy I will be eager to read it.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .