How mathematical entropy works
Mathematical entropy is measured in bits, representing the total size of the keyspace. The Shannon formula evaluates the length of the string and the size of the character pool: lowercase and uppercase Latin, digits, special characters, and extended Unicode.
For EFF Diceware passphrases, the calculation differs: random words are selected from a standardized list of 7,776 words. Each word adds approximately 12.92 bits of pure entropy, allowing teams to create memorable passphrases with strong brute-force resistance.
| Entropy Tier | Resistance Level | Offline Crack Time (8x RTX 4090) | Real-World Security |
|---|---|---|---|
| Under 40 bits | Critically Weak | Under 1 second | Compromised instantly by automated scanners |
| 40-64 bits | Weak | Seconds to several hours | Vulnerable to dictionary and mask attacks |
| 65-79 bits | Moderate | Days to months | Resists generic attacks; vulnerable to targeted cracking |
| 80-99 bits | Strong | Decades to millennia | Fully immune to mathematical offline brute force |
| 100+ bits | Cryptographic | Millions of years | Mathematically unbreakable without endpoint compromise |
Why 100 bits of entropy fails without 2FA
High entropy eliminates offline hash cracking in laboratory conditions. However, in real business operations, threat actors rarely brute-force complex passwords: they steal them via infostealer malware, intercept them on phishing portals, or dump them from active browser sessions.
Without hardware multi-factor authentication (FIDO2 / YubiKey), even a perfectly generated 120-bit password remains a single point of failure. If submitted on a spoofed login page or an infected computer, attackers gain immediate access regardless of password length.