# 64 bits password = 13 characters?

If we use upper and lower case letters, and 10 digits, we get approximately 6 bits per character. Then, strings of 13 characters should work.

I saw above explanation in the material, but I cannot understand how 13 characters are appeared. How can I compute?

## 2 Answers

It's likely an error. The number of possible passwords of length $$l$$ from a character set size of $$n$$ is $$n^l$$. The number 13 probably came from a calculation for a character set with only one case. A set of $$36^{12}$$ passwords is smaller than a set of $$2^{64}$$. You need one additional character to get 64 bits of information.

$$36^{12} < 2^{64} < 36^{13}$$

A 13 character long password from a 62 element character set is equivalent to

$$\log_2(62^{13}) = 13 * \log_2(62) \approx 77.4 \ \text{(bits)}$$

The actual minimum number of characters for that character set is

$$\lceil\log_{62}(2^{64})\rceil = \lceil64 * \log_{62}(2)\rceil = 11 \ \text{(characters)}$$

And for that character set there are $$\log_2{62} \approx 5.95$$ bits of information per character. You can get the same number $$11 = \lceil 64 / ~5.95 \rceil$$.

A 13 character string* is sufficient to get a password with at least 64 bit strength. However that's satisfied by any number of characters no less than 11, making 13 characters unnecessarily long.

* Randomly selected from a uniform distribution

Suppose the number of a set $$S$$ is denoted as $$Card(S)$$ (which is sort for cardinality if you didn't know), then

$$Card($$uppercase-letters$$)+Card($$lowercase-letters$$)+Card($$digits$$) =26+26+10=62$$

To represent an element from a set of 62, you need a string of at least 6 bits, this is because $$2^{6} = 64 \ge 62$$

However I don't understand the title where it says "64 bits password = 13 characters" because $$6 \cdot 13 = 78$$ which is way bigger here, than 64.

To achieve at least 64-bit entropy, you need to uniformly draw $${ {64} \over {log_2{62}} } \approx 11.00$$ characters (10.749 to be more exact).