How to Create Strong Passwords and Measure Password Entropy: NIST SP 800-63B Guidelines

The Mathematics of Password Entropy

Password strength is quantified by information entropy (measured in bits). Entropy represents the logarithm base 2 of the total search space an attacker must explore during an exhaustive offline brute-force attack:

Entropy (bits) = L * log2(R)

Where L is the password length (number of characters) and R is the size of the character pool (radix) from which each character is independently chosen. Because entropy scales linearly with length but only logarithmically with character pool variety, increasing length provides vastly superior security.

Entropy & Crack-Time Comparison Table

Modern NIST SP 800-63B Guidelines

The National Institute of Standards and Technology (NIST) Special Publication 800-63B overturned many legacy corporate password policies that are now recognized as harmful:

• Eliminate Arbitrary Complexity Rules: Forcing users to include at least one uppercase letter, number, and special character leads to predictable patterns (e.g. capitalized first letter, ending in !1). Focus on length instead.
• Eliminate Periodic Mandatory Rotation: Forcing password changes every 90 days causes users to make trivial increments (e.g. Spring2026! -> Summer2026!). Passwords should only be changed upon known compromise.
• Check Against Compromised Password Lists: Applications must screen new passwords against breach databases (e.g., HaveIBeenPwned API) to block leaked credentials.
• Allow Long Passphrases & Password Managers: Allow minimum 12-16 characters and support maximum lengths up to 64+ characters with full space and emoji support.

Passphrases & The Diceware Method

Diceware creates high-entropy, human-memorable passphrases by rolling physical 6-sided dice 5 times to look up words in a standardized 7,776-word dictionary (6^5 = 7,776). Each selected word contributes log2(7776) ≈ 12.92 bits of pure cryptographic entropy. A 5-word passphrase provides ~65 bits of entropy, easily exceeding standard brute-force capabilities while remaining effortless to type.

Calculating Entropy in TypeScript & Python

// Accurate Password Entropy Calculator in TypeScript
export function calculatePasswordEntropy(password: string): { bits: number; rating: string } {
  if (!password) return { bits: 0, rating: 'Empty' };

  let poolSize = 0;
  if (/[a-z]/.test(password)) poolSize += 26;
  if (/[A-Z]/.test(password)) poolSize += 26;
  if (/[0-9]/.test(password)) poolSize += 10;
  if (/[^a-zA-Z0-9]/.test(password)) poolSize += 33; // Standard printable symbols

  const bits = Math.round(password.length * Math.log2(poolSize || 1));

  let rating = 'Very Weak';
  if (bits >= 80) rating = 'Very Strong';
  else if (bits >= 60) rating = 'Strong';
  else if (bits >= 40) rating = 'Moderate';

  return { bits, rating };
}