Question 1

What is password entropy?

Accepted Answer

Entropy measures how unpredictable a password is, in bits. Each extra bit doubles the number of guesses needed. A truly random password's entropy is length times log2(character-set size), but real passwords are far weaker than that formula suggests because humans pick predictable patterns that attackers model directly.

Question 2

Why does a longer passphrase beat a short complex password?

Accepted Answer

Attack cost grows exponentially with length. 'correcthorsebatterystaple' is 25 characters of ordinary words yet has a vast search space, while 'Tr0ub4dor&3' is short enough that rule-based cracking reaches it far sooner. Length adds entropy faster than swapping letters for symbols, and it is easier to remember.

Question 3

Why can a 'complex' password still be cracked instantly?

Accepted Answer

Because attackers do not brute-force blindly — they run dictionaries, leaked-password lists, and mangling rules first. 'Summer2024!' hits all four character classes but matches a template crackers try immediately. Predictability, not character variety, is what determines real-world crack time.

Entropy Guess

How to play

Frequently Asked Questions