Your password strength calculator is completely wrong. If I enter a 60 character lowercase sentence in there, your calculator will tell me it's a weak password, even though you won't be able to bruteforce it because of the sheer size.
The primary indicator of password strength is something called entropy. Basically, it indicates how random your password is. Entropy at its most basic form is "how many passwords could I make using your method?" and is measured in bits. It is calculated by the following formula:
entropy = number of bits in the binary representation of(the size of your charset)^(length of your password in chars)
the size of your charset is usually one of the following options:
- 26 (only lowercase)
- 36 (lowercase + digits)
- 52 (uppercase and lowercase)
- 62 (uppercase, lowercase and numbers)
- 95 (uppercase, lowercase, numbers and symbols)
I say usually because some people don't use characters for their charset. Some people use a passphrase. And that's where the difficult part comes in. You see, a passphrase is basically a password where someone uses words from their native language for the charset. The English language currently has well over a million words, and many other languages have similarly exhaustive vocabularies. Even if you drop all the words longer than, say, 10 characters, you're still left with hundreds of thousands of words. If you have 500,000 words and choose 5 random words, you have 31 octillion (quadrilliard for those that use the -iard system) possibilities.
Because of this, you also need to account for passphrases when calculating your entropy. The hard part is that the algorithm that generates passphrases might be flawed. For example, if I have the password "apple aardvark acumen autumn aiming", that's 35 lowercase characters long. If you have a naive entropy calculator that doesn't account for passphrases, that's equal to an entropy a 3 followed by 49 zeroes. However, all the words start with the same letter a. there are only about 13,000 words that start with the letter a in English, and there are only 5 words. By the same entropy math, that's an entropy of 3 followed by 20 zeroes. that's a HUGE difference. If you go by "how many characters", your password is just about unbreakable for years to come. If you go by "how many words starting with the letter a", your password could probably be beaten in hours.
The big challenge with calculating the entropy of passphrases is that you can't define a dictionary size. For example, your passphrase might have 5 words with different starting letters, but they're all in the list of 1000 most common words, so it can be broken instantly. Or your passphrase has no spaces, which suddenly means your passphrase has only 4 words instead of 5 because you can interpret it differently, which has a HUGE effect on how strong your password is.
Entropy is rather hard to calculate with regards to passwords because of the above challenges. A good place to start is by calculating your entropy based on just the DULS character set: Digits, Upper, Lower, Symbols. Work out how big your character set size is based on those groups, then raise that to the power of the password length. The entropy is then the logarithm in base 2 of the number you get. You'll have to use your personal judgment on what entropy gives what grade. Here are some examples of how entropy relates to character length.:
- 106 = 19 bits (a random number between 100,000 and 999,999, inclusive.)
- 268 = 37 bits (8 lowercase characters, aka "password", although this is one of the first a hacker will try).
- 958 = 52 bits (8 printable characters).
- 2616 = 75 bits (16 lowercase characters).
- 500,0005 = 94 bits (5 of the 500,000 most popular words, randomly chosen).
- 9516 = 105 bits (16 printable characters).
- 9530 = 197 bits (30 printable characters).
'
or"
) and never before, unless it's an ellipsis (…
) \$\endgroup\$ – Fund Monica's Lawsuit Nov 7 '15 at 20:44