Linked Questions

-1 votes
1 answer
291 views

How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]

Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
Atomic Tripod's user avatar
1287 votes
23 answers
289k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
59 votes
38 answers
13k views

What is your way to create good passwords that can actually be remembered?

What are the methodologies which can be used to generate "human" good quality password? They have to ensure a good strength and also easy to remember for a human being.
10 votes
6 answers
6k views

What is the best way to calculate true password entropy for human created passwords?

Okay, I know it might seem this has already been beaten to death but, hear me out. I am including a fairly good password strength algorithm for my app for users on sign-up. This one, which I've copied ...
RobbB's user avatar
  • 261
25 votes
3 answers
15k views

Calculating password entropy?

Whenever I look at password entropy, the only equation I ever see is E = log2(RL) = log2(R) * L, where E is password entropy, R is the range of available characters, and L is the password length. I ...
Moses's user avatar
  • 2,167
14 votes
3 answers
2k views

An alternative to traditional passwords: is there some merit to this idea?

If you've got a website aimed at people that are not necessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
AardvarkSoup's user avatar
13 votes
2 answers
2k views

How should I make diceware passphrases more memorable?

I find that truly random diceware passphrase, more often than not, either contain a word that is easily misspelled or has an order that is illogical. I think there are three ways to make a diceware ...
tony's user avatar
  • 283
12 votes
1 answer
3k views

Howto seed the PRNG in OpenSSL properly?

I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...
efr4k's user avatar
  • 507
2 votes
2 answers
925 views

Is it really "Time to add a word" if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
Dick99999's user avatar
  • 525
7 votes
1 answer
951 views

How genuine are password entropy calculations?

I apologise for perhaps the confusing title, I'll try and elaborate a little better. Many discussions I see surrounding password entropy focus on the specific context of the range of choices ...
Peleus's user avatar
  • 3,907
2 votes
0 answers
320 views

Passphrase generator and strength & recovery time estimator. Right strength and randomness?

Questions about the strength of pass phrases frequently popup, as does: how to generate a strong passphrase? I tried to combine both in a tool. The free tool also includes recovery time estimations ...
Dick99999's user avatar
  • 525