Password Entropy & Mathematical Security: The Developer's Guide
For decades, users were instructed to pick passwords with complex character substitutions (e.g. P@ssw0rd!). Today, NIST (National Institute of Standards and Technology) guidelines explicitly advise against artificial complexity requirements. Instead, length and true randomness are the mathematical foundations of password security.
Calculating Information Entropy
Entropy measures the unpredictability of a password, quantified in bits. The formula for password entropy is:
Where L is the password length, and R is the size of the character pool:
- Lowercase only: 26 characters (
log2(26) ≈ 4.7 bits/char) - Lowercase + Uppercase: 52 characters (
log2(52) ≈ 5.7 bits/char) - Letters + Numbers: 62 characters (
log2(62) ≈ 5.95 bits/char) - Full ASCII (Letters, Numbers, Symbols): ~94 characters (
log2(94) ≈ 6.55 bits/char)
Why Math.random() is Forbidden for Passwords
In JavaScript, Math.random() uses pseudo-random algorithms (like xorshift128+) that are not cryptographically secure (PRNG). An observer who sees a few outputs can reconstruct the internal seed state and predict subsequent passwords.
Our client-side password generator utilizes window.crypto.getRandomValues(), querying the operating system's entropy pool for cryptographically strong random values.