Why It’s Always Better to Use a Longer Password

Have you ever signed up for a new online account and been frustrated by the password requirements? The service often insists on a longer password and the inclusion of special characters. While it might seem inconvenient, there’s a good reason for these demands. It’s all about entropy.

But what exactly is password entropy? What does it have to do with a longer password? Let’s take a deeper look.

What is Password Entropy?

Password entropy is essentially a measure of how unpredictable or random your password is. Think of it like a game of dice. A six-sided die has six possible outcomes. The more sides a die has, the more unpredictable the result. Similarly, a password with more possible combinations is harder to guess.

Entropy is measured in bits, the basic unit of information in computing. Generally, experts recommend a entropy of at least 64 bits. While this number is debated, a higher entropy means a more random and, therefore, more secure.

Now, why is randomness important? When an attacker tries to access your online account, they often target your password. If it is easy to guess, it’s like leaving the door unlocked. A strong, random text acts as a sturdy lock, making it much more difficult for unauthorized individuals to gain access.

Dictionary Attack to Crack Passwords

One of the most common methods used by attackers to crack passwords is a dictionary attack. In this technique, a program systematically tries various combinations of words and phrases from a dictionary or list of common passwords. It’s like a brute-force guessing game, but with a more targeted approach.

Imagine a hacker using a dictionary attack. They would feed the program with a list of common words, phrases, and even variations. The program would then attempt to match these combinations. If a match is found, the attacker has successfully gained access to your account.

The Limitations of Predictability

Dictionary attacks are a form of brute force, essentially using brute strength to crack passwords. They’re surprisingly effective, often breaking simple passwords in mere seconds. Cybersecurity firms like Hive Systems have published data showcasing the vulnerability of predictable texts.

Since dictionary attacks rely on predictable patterns, the best defense is to introduce randomness into your passwords. Many people instinctively try to add symbols to their existing passwords, like “p@ssword” or “password123.” However, this isn’t random. Attackers can easily account for such predictable changes, and it might only take a fraction of a second longer for them to gain access.

To create a truly random password, you need to remove human intervention. A computer-generated password, created using a random number generator, is much more secure. This is where password managers excel. These tools can generate and store strong, random texts for you, making it much more difficult for attackers to crack.

The Importance of Longer Passwords

While all four factors—length, special characters, uppercase letters, and numbers—contribute to password entropy, length plays a particularly significant role. To understand why, let’s delve into a bit of mathematics.

Imagine a password consisting only of lowercase letters. There are 26 letters in the alphabet. If your password is 6 characters long, there are 26^6 (or 26 to the power of 6) possible combinations. This equates to over 300 million possibilities.

Now, let’s add a single character to the password, making it 7 characters long. The number of possible combinations increases to 26^7, which is over 8 billion. As you can see, even a small increase in length dramatically expands the number of potential combinations.

This is why length is so crucial. The longer your password, the more possibilities there are, making it exponentially harder for an attacker to guess.

More About the Entropy

While we can measure password entropy, it’s also possible to calculate it using a specific formula. The formula is as follows: E = log2(RL)

• E represents the entropy, which is the final result we’re aiming for.
• L is the length of the password, measured in characters.
• R is the range, which represents the number of characters available to you.
• log2 is a mathematical function used to calculate the number of bits needed.

Let’s break down the range concept. If you’re using a standard US keyboard layout and only lowercase letters, your range is 26. For example, a password of 8 characters using only lowercase letters would have an entropy of 37.60 bits, which is very weak.

By adding uppercase letters, you double your range to 52. This increases the entropy to 45.60 bits, which is still not ideal. Including digits 0-9 brings the range to 62, and adding symbol keys further increases it to 95. Even with these additions, an 8-character password would only have an entropy of 52.56 bits, falling short of the recommended 64 bits.

To significantly improve your password’s entropy, the most effective method is to simply increase its length.

How Long Should Be Your Password?

Now that we understand the importance of entropy, the question becomes: how long should it be? The answer depends on your desired level of security. While 64 bits is a common benchmark, given the rapid advancements in cracking technology, it’s wise to aim for a higher entropy, perhaps around 100 bits.

Using the entropy formula, we can calculate that a 16-character text using all 95 available characters would provide an entropy of 105.12 bits. A 15-character option would still offer a decent level of security at 98.55 bits. However, anything shorter would put you in dangerous territory.

If you’re working with a smaller character set (less than 95), you’ll need to increase the length further to achieve the same level of entropy.