The Mathematics of Shannon Password Entropy
In 1948, Claude Shannon published his seminal paper A Mathematical Theory of Communication, introducing "entropy" as a metric for the information content or unpredictability in a message. In cybersecurity, this exact formula measures the resistance of a secret string to brute-force discovery:
E = L × log2(R)
Where:
- L: Length of the password (number of characters).
- R: Size of the character pool from which each character is uniformly chosen.
- E: Total bits of information entropy.
Why Bits of Entropy Matter More Than Length Alone
Every single bit added to a password's entropy doubles the total number of guesses an attacker must compute. A password with 80 bits of entropy is not twice as strong as a 40-bit password—it is 240 (over 1 trillion) times stronger.