Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a password with a prescribed format:

111 + “2 Random lowercase letters” + “random digit”

As you can see, it starts with a fixed value of 111, followed by two random lower case letters, and then lastly a random digit. Now, I would like to calculate the password entropy. To do so, I am calculating:

Fixed value 111 $\rightarrow log2(1) = 0\text{ bits}$
Two random lowercase letters $\rightarrow log2(26)\times2 = 9.4\text{ bits}$
One random digit $\rightarrow log2(10) = 3.3\text{ bits}$

This results in a total password entropy of $0 + 9.4 + 3.3 \text{ bits} = 12.7\text{ bits}$

Is this approach to calculate the password entropy correct, or am I missing something somewhere?

share|improve this question
up vote 6 down vote accepted

Yes, the computation is correct: the passwords will have an entropy of $log_2(26^2\cdot10)\simeq {12.7}$, which means that they are weaker than a randomly chosen secret key with 13 bits.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.