Password length versus alphabet size: a bit-count comparison

People often judge a password by how many different kinds of character it contains. A more useful way to compare random passwords is to count how many equally likely possibilities a generator could have produced. Taking the base-2 logarithm of that count gives a number of bits.

The arithmetic

If every character is chosen independently and uniformly from an alphabet of N symbols, a password of length L has N to the power L possibilities, which is L times log2(N) bits.

• 8 characters from all 94 printable ASCII symbols: 8 x 6.55 = about 52.4 bits
• 12 characters from letters and digits (62 symbols): 12 x 5.95 = about 71.5 bits
• 16 lowercase letters only (26 symbols): 16 x 4.70 = about 75.2 bits
• 4 words picked at random from a list of 7,776 words: 4 x 12.92 = about 51.7 bits

So a longer password drawn from a smaller alphabet can beat a shorter one with symbols. Each extra character adds log2(N) bits, so length matters more than adding a rare symbol class.

A browser-based password generator can produce candidates of a chosen length; use the arithmetic above to judge how many bits a given setting gives, and check what source of randomness any generator uses.

Common mistakes

1. Applying the formula to human-chosen passwords. The count only holds when each character is picked at random. Patterns such as a capitalised word followed by a digit have far fewer possibilities than the formula suggests.
2. Counting bits for a password you modified. If you regenerate until you like the look of the result, you have narrowed the space.
3. Reusing one password. Bits describe guessing resistance, not what happens when a site leaks it. A unique password per site limits the damage.
4. Mixing up bits and characters. Twenty bits is about a million possibilities, not twenty of anything.

A check you can do

Compute 62 to the power 20 in your head as roughly 119 bits (20 x 5.95). Then compare that with 26 to the power 16, about 75 bits, to see how much each extra character is worth.

Published by the caesarcipher.org team; drafted with AI assistance.