# When knowing an individual's plaintext password history, how much information is expected to be gained with a new password? Do we know this?

The premise: Knowing a persons password history should provide information to help when guessing a new password of theirs.

At an extreme end, with a password history of `wildcats`, `wildcats1`, then `wildcats2`, I'd guess there is less than 1 bit of entropy in their next answer.

At the other extreme end, someone with randomly generated passwords would lose no information in their history. From an information-theoretic point of view, I imagine this is something we can estimate using the large amounts of password history data available in the world.

Somewhere in the middle, a history of "wildcats!Reddit", "crazydogs!Facebook", "locobirds!Stackexchange" would give me some good ideas for a Twitter password, and would greatly reduce the entropy of their hash. Of course, this would be related to the concept of password strength.

I'm not so well-read on security, but I assume my idea is not unique. Is there a name for this concept? Do we know any real-world values for the amount of information gained / entropy lost?

• I'm a little unclear on what you're looking for. Are you looking for info on what percentage of users, on average, choose sequential passwords with predictable variations? Or something like the average Levenshtein distance between sequential passwords? – PwdRsch Jun 21 '19 at 21:04
• No, but I don't know how to modify my answer to be more clear. With an alphabet of 64 characters, the entropy per character of a password is probably less than 6 bits, because humans do not pick passwords uniformly random. I.e. we have information about the distribution of passwords. We can then quantify password strength or entropy given this information. Why stop there? If we know other passwords that a specific person has used, then we have more information to use, and have probably reduced the password strength further. Surely this is not an original idea? – lynn Jun 23 '19 at 1:07
• I imagine it would take a research paper to actually give you any kind of answer. – forest Jun 23 '19 at 5:08