What entropy tells you about password guessing
Entropy depends on how the password was generated. Eighteen characters chosen independently from a 62-character alphabet give about 107 bits of entropy. A human-chosen string of the same length can be much easier to guess.
Online guessing depends on controls such as sign-in rate limits. Offline guessing depends on the hash or key derivation function and the resources available to the attacker.
What a Diceware passphrase protects
The EFF long list contains 7,776 words. Six independently selected words give about 77.5 bits of entropy. A copied example or a phrase you make up does not have the same estimate.
A passphrase can still be captured when it is entered or copied. Malware may also steal an existing browser session.
What happens when a second code arrives by email
Someone with access to an already signed-in inbox may be able to read sign-in or recovery codes. NIST does not allow email as an out-of-band authenticator and treats recovery separately.
A TOTP app on a separate device can limit exposure if a computer is compromised. A phishing page can still relay a code that the user enters.
How passkeys and security keys resist phishing
WebAuthn binds the credential to the service. A lookalike domain cannot ask the authenticator to sign in to the legitimate service with that service’s credential.
Some passkeys sync across devices. They can meet AAL2 when the deployment meets NIST requirements. AAL3 requires a non-exportable private key and other controls. A hardware security key may qualify in a compliant deployment. A stolen browser session is a separate risk.
Compare sign-in methods and NIST assurance levels
| Method | Phishing resistance | If a browser session is stolen | NIST SP 800-63B-4 |
|---|---|---|---|
| Password only | Can be captured | Session can be reused | Can meet AAL1 |
| Password + email code | Code can be captured | Session can be reused | Email is not accepted as out-of-band authentication |
| Password + SMS code | Code can be relayed | Session can be reused | Restricted method, can meet AAL2 under conditions |
| Password + TOTP | Code can be relayed | Session can be reused | Can meet AAL2 under conditions |
| Synced passkey | Phishing-resistant sign-in | Session can be reused | Can meet AAL2 under conditions |
| FIDO2 with a non-exportable key | Phishing-resistant sign-in | Session can be reused | Can meet AAL3 if all requirements are met |
Choose a method for each account
For administrator accounts, prefer phishing-resistant sign-in. Check the authenticator and the service configuration against your requirements, and test a backup method before you need it.
Document account recovery and how to revoke sessions after a device loss. Where passkeys are unavailable, TOTP can add a second factor, with the phishing limitations above.
