Information Theory & Password Security: The Shannon Entropy Model
Information Security • Cryptographic Bit Depth Analysis
1. Shannon Entropy Formula
Password strength is mathematically defined by Information Entropy, measuring the number of bits of randomness in a string:
Where \(L\) is the password length and \(N\) is the size of the character pool (e.g., \(26+26+10+32 = 94\)). A 20-character password drawn from a 94-character pool yields \(20 \cdot \log_2(94) \approx 131\) bits of entropy.
2. Why True Hardware Randomness (Web Crypto API) Matters
Standard Math.random() implementations are pseudo-random number generators (PRNGs) susceptible to seed reconstruction attacks. Our generator uses window.crypto.getRandomValues(), leveraging hardware entropy gathered from operating system kernel interrupts.
3. FAQ
How many bits of entropy are safe?
NIST recommends at least 64 bits for standard accounts and \(\ge 112\) bits to withstand state-level GPU brute-force clusters.
Are generated passwords logged?
Never. The generated string lives purely in local volatile RAM and is erased immediately upon browser refresh.