Password strength and generation

The lecture's entropy arithmetic in full, including a corrected worked example where the source's own number is wrong, and the generation methods it recommends to reach that entropy without losing memorability.

Compute the total number of possible passwords for a character set and length using N = C^L, and the entropy in bits that follows from it.
Identify the lecture's 72^12 worked example as a source defect and reproduce the corrected combinatorial value.
Generate a passphrase with the EFF dice method and compute its entropy from the wordlist size and word count.
Explain the letters-from-a-sentence and PAO methods, and the tradeoffs of password managers.
Describe the passkey registration and verification flows and explain why neither transmits a password.

24 min read

Intuition

02-05 showed that a composition rule can accept Password123! and reject a genuinely random string, because compliance with a rule is not the same property as actual unpredictability. This page gives the measure that rule was failing to track. A password’s strength is not how it looks; it is how many guesses an attacker needs on average before one of them matches, and that number follows directly from two facts: how many different characters could go in each position, and how many positions there are.

Mechanism

The lecture reduces this to two formulas. First, the total number of possible passwords for a character set of size $C$ and a length of $L$ characters: $N = C^L$ Second, the entropy, in bits, that this combinatorial count represents: $H = \log_2 N = L \log_2 C$ $N$ answers “how many passwords exist.” $H$ answers “how much uncertainty does an attacker face,” and it is $H$ , not $N$ , that the lecture calls a password’s strength.

Formula

Password combinatorics

N = C^L

$N$: total number of possible passwords
$C$: size of the character set
$L$: password length in characters

Formula

Password entropy

H = \log_2 N = L \log_2 C

$H$: entropy in bits
$N$: total combinations, C^L
$L$: password length
$C$: character-set size

Worked example

AnswerN = 26^6 = 308,915,776; H ≈ 28.2 bits

Character set: lowercase letters only, $C = 26$ . Length $L = 6$ .
Combinations: $N = C^L = 26^6 = 308{,}915{,}776$ .
Entropy: $H = \log_2 N = 6 \log_2 26$ . $\log_2 26 \approx 4.7004$ , so $H \approx 6 \times 4.7004 \approx 28.20$ bits.

Worked example

AnswerN = 72^8 ≈ 7.22×10^14; H ≈ 49.36 bits

Character set: upper case + lower case + digits + 10 special characters, $C = 26 + 26 + 10 + 10 = 72$ . Length $L = 8$ .
Combinations: $N = C^L = 72^8 = 722{,}204{,}136{,}308{,}736 \approx 7.22 \times 10^{14}$ .
Entropy: $H = \log_2 N = 8 \log_2 72$ . $\log_2 72 \approx 6.1699$ , so $H \approx 8 \times 6.1699 \approx 49.36$ bits.

Worked example

AnswerN ≈ 1.94×10^22 (the lecture prints ≈3.7×10^22, a source defect); H ≈ 74.1 bits, correct as printed

Same 72-character set, $C = 72$ , length $L = 12$ .
Split the exponent in half to keep the numbers manageable: $72^6 = 139{,}314{,}069{,}504$ .
$N = 72^{12} = (72^6)^2 \approx (1.393 \times 10^{11})^2 \approx 1.94 \times 10^{22}$ .
Entropy: $H = \log_2 N = 12 \log_2 72 \approx 12 \times 6.1699 \approx 74.04$ bits, matching the lecture’s own printed $\approx 74.1$ bits.

Aside

week02-notes.md’s own working prints $N = 72^{12} \approx 3.7 \times 10^{22}$ for this example, about $1.9$ times the correct value above (docs/FACTS.md S4). The paired entropy line in the same example, $H \approx 74.1$ bits, is unaffected: it is computed correctly from the true $N$ , and the error sits only in the combinatorial figure printed alongside it. Reproduce the corrected $N$ if this example comes up; the printed $H$ can be used as it stands.

Pitfall

$N$ and $H$ answer different questions. $N$ is how many passwords exist; $H = \log_2 N$ is how many bits of uncertainty that represents, and it is $H$ that the lecture and this site call “entropy” or “strength.” A question asking for entropy wants a number in the twenties to eighties, not a twenty-two-digit combinatorial count. Writing $N$ when $H$ was asked loses marks even when every digit of $N$ is correct.

Threat

An attacker holding a stolen password list, hashed and salted or otherwise, does not start with brute force. The lecture’s reasoning is cost: trying every combination is expensive, so attackers run a dictionary attack first, checking the list against known words, previously breached passwords, and common substitutions, before falling back to exhausting the full character set. Either attack, given enough time at a high enough guess rate, eventually finds a password with low entropy. This is the storage side of the disclosure concern 02-05 covers; entropy is what decides whether “eventually” means seconds or millennia.

Worked example

Answer26^6 password: under a second. 72^12 password (corrected N): roughly 300,000 years, both at 10^9 guesses/second.

Use the average case from the two entropy examples above: an attacker expects to find the password after searching half the keyspace, not all of it.

Weak case (first example): $N = 308{,}915{,}776$ . Average guesses $= N / 2 = 154{,}457{,}888$ .
At $10^9$ guesses per second, a fast offline hash cracked on a GPU: $154{,}457{,}888 / 10^9 \approx 0.15$ seconds.
Strong case (corrected 72^12 example): $N \approx 1.94 \times 10^{22}$ . Average guesses $\approx 9.7 \times 10^{21}$ .
At the same rate: $9.7 \times 10^{21} / 10^9 = 9.7 \times 10^{12}$ seconds.
Converting to years, at $\approx 3.156 \times 10^7$ seconds per year: $9.7 \times 10^{12} / 3.156 \times 10^7 \approx 3.1 \times 10^5$ , roughly 300,000 years.

Control

Entropy, not apparent complexity, is what closes that gap. The corrected 72^12 example and the six-word dice passphrase below both clear roughly 74 to 78 bits, and at that level even an offline cracking cluster is looking at hundreds of thousands of years on average, not a workable attack. Every generation method the rest of this page covers exists to reach that range without asking a person to memorise seventy-odd bits of genuine randomness directly.

Estimate the strength of a charset-based password or a diceware-style passphrase: bits of entropy, total combinations, and mean time to guess.

Character set

Length

Guess rate

Mechanism

Length and unpredictability are exactly what human memory is bad at holding, the same tension 02-05 names for ordinary passwords. The lecture gives four tried methods for reaching enough entropy while keeping the result recoverable from memory: password managers, the dice method, letters-from-a-sentence, and PAO. A password manager removes the memory problem outright, since the user never has to hold the string at all; the other three trade a fixed, repeatable procedure for the raw randomness a strong password needs.

Exam detail

Password managers. A password manager stores every password behind one strong master password, generates long, high-entropy strings on request, and typically integrates with the browser to fill them in directly. Apple Keychain, the built-in browser managers, Bitwarden and LastPass are the lecture’s named examples. Because the manager, not the user, is choosing the string, entropy stops being limited by what a person can memorise at all.

The lecture names four drawbacks it treats as real rather than hypothetical: losing the master password loses every stored password at once; mobile support and cross-device sync remain uneven, though better than before; the extra step of opening the manager makes for a longer login workflow; and some sites block pasting into a password field, which the lecture calls a bad idea outright, not a legitimate security measure.

Exam detail

Dice method. Roll five standard six-sided dice and record the result as a five-digit sequence, each digit 1-6. Look that sequence up in a word list built so every possible five-roll sequence maps to exactly one word, the EFF’s Long Wordlist in the lecture’s example. Repeat for as many words as the passphrase needs, and string them together. The lecture’s own worked example, thirty rolls: 54452 61644 63545 53161 42142 looks up as sizable tapioca undoing scalded nemesis. Turning the words into a sentence (“The sizable bowl of tapioca pudding was undoing my patience…”) makes the sequence easier to hold in memory than the same words in isolation, since people remember sentences better than word lists, and word lists better than digit strings.

The wordlist has to contain exactly $6^5 = 7{,}776$ words for the mapping to cover every possible roll sequence with no gaps and no collisions. Today’s recommended passphrase length is six words. The typing cost is real and is the method’s one acknowledged drawback: six dictionary words is a lot more keystrokes than a twelve-character mixed-case string.

Formula

Passphrase entropy (dice method)

H = n \log_2 W

$n$: number of words chosen
$W$: wordlist size, 7,776 for the EFF long list

Worked example

Answer7,776^6 ≈ 2.2107×10^23 combinations; H ≈ 77.55 bits

Wordlist size $W = 7{,}776 = 6^5$ (the EFF long list, one word per five-die roll). Word count $n = 6$ , today’s recommended length.
Total combinations: $N = W^n = 7{,}776^6 \approx 2.2107 \times 10^{23}$ .
Per-word entropy: $\log_2(7{,}776) = \log_2(6^5) = 5 \times \log_2 6 = 5 \times 2.58496 \approx 12.9248$ bits.
Total entropy: $H = n \times \log_2 W = 6 \times 12.9248 \approx 77.55$ bits.

Exam detail

Letters-from-a-sentence. Pick a memorable sentence and take one or two letters from each word. The lecture’s example: Wow! 62 students, all in this memorable class of 2026! becomes W!62s,aitmc02o26!. The method tends to produce upper case, lower case, digits and special characters without the user inventing any of them separately, since an ordinary sentence about a real memory already contains all three. It also extends cleanly: taking a second letter per word, as the lecture does, lengthens the password while the sentence itself stays the same size in memory.

Exam detail

Person-Action-Object (PAO). Choose a person and a place, then invent a random action linking them to an object. The stranger the scenario, the more memorable the image. The lecture’s example: Darth Vader riding a pony on Mt Everest. Apply a fixed rule to turn the scenario into characters: first two letters of each word gives DVrapoMtE!, and substituting characters for sounds extends it further to DVr4poMt3!. The rule has to stay fixed and be applied consistently, or the method loses the one thing that makes it faster to recall than a password chosen at random: a repeatable procedure standing in for memorised characters.

Mechanism

Passkeys remove the password from the exchange entirely. Registration and verification never send a secret across the network at all: what moves between the device and the site is a cryptographic key pair and a signed challenge, not something an attacker who intercepts or steals it could reuse to log in as the user.

Exam detail

Registration. The user starts registration on the site, which the lecture calls the relying party. The relying party generates a random challenge and sends it to the user’s device. The user verifies locally, by fingerprint, face or PIN. Once that succeeds, the device (the authenticator) generates a fresh public-private key pair. The private key never leaves the device: it stays in a secure enclave or TPM. The public key, together with the signed challenge, goes to the relying party, which stores the public key for future logins.

Exam detail

Verification. Login starts the same way: the user initiates it, and the relying party issues a new challenge. The user verifies locally again. The device signs the new challenge with the private key it already holds, and sends the signature back. The relying party checks the signature against the public key it stored at registration; a match authenticates the user. No password, and no shared secret of any kind, is ever transmitted.

Compare

A password is a shared secret. The server stores something derived from it, ideally hashed and salted, and the same string is retyped and sent at every login. A breach of that stored list, or a phished or intercepted entry, hands the attacker something they can try to crack or reuse directly.

The private key never leaves the device. The server stores only a public key, which cannot sign a login on its own. Every login is a fresh challenge the device signs, never a secret sent over the wire, so a server-side breach yields public keys an attacker cannot authenticate with.

Recall

A password manager generates a 20-character random string from the full 95-character printable ASCII set. Using H = L x log2(C), roughly how many bits of entropy is that, and how does it compare to the corrected 72^12 example and the six-word dice passphrase above?

$H = 20 \times \log_2 95 \approx 20 \times 6.57 \approx 131$ bits. That clears both the corrected 72^12 figure (≈74 bits) and the six-word dice passphrase (≈77.55 bits) by a wide margin, without asking anyone to remember a single character of it.

Source

Week 2 Notes PDF