# True 128bit secured password length?

assume we say 128bit keys are secure so a 16 character long password is safe, but if i even use lower case and upper case letters with numbers and special characters on my keyboard its about 80 different character i can choose, as we have 256 different byte in nature so it look like the 16 character random password i choose is about a 60 bit secure key ... ?! how to fix it and what is secure length to use ?

• 16 character password $\neq$ 128 bits of entropy. To fix it, either add more characters to your password, or use a slow KDF (key derivation function) to add some more bits of security to your key in the form of computational cost, see PBKDF2, bcrypt, scrypt, ... you can probably get an extra 24 bits at most before this becomes inconvenient to the user. Dec 21, 2012 at 13:45
• well Thomas most of crypto tools such as Trucrypt etc always ask you enter your password don't say import a key, so password is what we use in real life not keys because it must be something we remember .. so what is correct password length with a regular keyboard for 128bit security ?
– mary
Dec 21, 2012 at 14:00
• Dec 21, 2012 at 14:44

If your alphabet (set of all possible characters) has size $s$ and your password has length $l$, a randomly generated password has a strength of $\log_2s^l = l\cdot\log_2s = l\cdot\frac{\log_{10}s}{\log_{10}2}$ bits.
This means if you want to create a 128-bit password using a 80-character alphabet, you need at least $\left\lceil128\cdot\frac{\log_{10}2}{\log_{10}80}\right\rceil = \left\lceil20.25\right\rceil = 21$ characters.