| > It's not really meaningful to measure entropy of a single password Here’s a ‘not meaningful’ formula then: E = L × log₂(R) • E is the entropy, in bits, representing how hard the password is to crack. • L is the password length (number of characters). • R is the size of the character set (e.g., 26 for lowercase letters, 52 for upper/lowercase, 62 if digits are included). • log₂(R) is the number of bits needed to represent each character. I hear your point: a single password might not actually use all character types, so the actual entropy could be less than its potential. Maybe they could have drawn from a wider range and didn’t. But for everyday user feedback, assuming the fewest sets seems fine to nudge people toward picking stronger passwords. |
If my string is "aaaa", does that mean its entropy is zero? There is at least information about its length. And by your definition, how do we know that this password isn't from a 256 character set? Does "Aaab" have 26 times the entropy of "aaab"?
Topics like this make more sense to me when the strings are infinite, or when the population of strings is known.