Question 1

How many bits of entropy is considered secure?

Accepted Answer

For most purposes, 80+ bits is strong; 128+ bits is considered very strong. A 20-character random password using mixed charset gives ~130 bits.

Question 2

Are passphrases stronger than random character passwords?

Accepted Answer

A 4-word passphrase from a 7,776-word list (Diceware) has entropy of 4 × log2(7776) ≈ 51 bits — less than a 10-character random password but far easier to remember. Use 6+ words for high security.

Question 3

Does entropy assume the attacker knows the charset?

Accepted Answer

Entropy calculations assume the attacker knows the generation method (charset and length) but not the actual password — the standard worst-case assumption in security analysis.

Question 4

What makes a password "bad" even with high entropy?

Accepted Answer

Reuse across sites, written down insecurely, transmitted over HTTP, or stored in plaintext all undermine theoretical entropy. Use a password manager to handle unique passwords properly.

Question 5

Is a longer password always better than a more complex one?

Accepted Answer

For entropy, yes — adding one character multiplies the search space by the charset size. Adding a symbol category only adds a few bits. Length is the dominant factor.

Password Generator — Free Online Calculator