I have a password with a prescribed format:

111 + (2 Random lowercase letters) + (random digit)

As you can see, it starts with a fixed value of 111, followed by two random lower case letters, and then lastly a random digit. Now, I would like to calculate the password entropy. To do so, I am calculating:

Fixed value 111 $\rightarrow \log_2(1) = 0\text{ bits}$
Two random lowercase letters $\rightarrow \log_2(26)\times2 = 9.4\text{ bits}$
One random digit $\rightarrow \log_2(10) = 3.3\text{ bits}$

This results in a total password entropy of $0 + 9.4 + 3.3 \text{ bits} = 12.7\text{ bits}$

Is this approach to calculate the password entropy correct, or am I missing something somewhere?


Yes, the computation is correct: the passwords will have an entropy of $\log_2(26^2\cdot10)\approx {12.7}$, which means that they are weaker than a randomly chosen secret key with 13 bits.

  • 2
    $\begingroup$ Assuming all 6,760 passwords are equally probable. This is an upper limit on entropy. If the passwords came from a non-uniform distribution then it would be lower. $\endgroup$ – Future Security May 4 at 2:39

The calculation is correct for the given information source.

I''m providing a second answer to emphasize that it's only meaningful to talk about the entropy of "information source" - that is mechanism from which data is generated.

Since the example given is a rule for creating passwords (insecure ones), it fits to discuss the entropy. Had it been a certain specific password string, it would be meaningless.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.