Password Strength by the Numbers: Entropy, Crack Time & Policy Design
Defensive password maths in a spreadsheet: character sets and search spaces, entropy bits, diceware-style passphrases, time to crack under illustrative attack speeds, length vs complexity, policy comparison with blocklists and MFA, reuse risk across sites and lockout math.
The first lesson is free — no account needed.
About this course
A password strength course that measures passwords and password policies with defensive math in a spreadsheet, for IT and security staff, system administrators, computer science students and anyone who writes a password policy. You add up character sets and compute every search space N^L, convert search spaces into entropy bits with LOG(N,2) and rate them, size a dice-based word list and find how many passphrase words beat 80 bits, turn average guesses into time to crack under illustrative online and offline attack speeds, fill a length-vs-complexity entropy grid and chart it, compare three policies for 2,400 staff on expected compromised accounts, calculate the chance that a reused password leaks from at least one site, and cap online guessing with lockouts and MFA. Current guidance, NIST's included, favours length, blocklists and MFA over forced complexity, and the labs show why. Defensive use only. The first lab is free.
Lessons
- Character Sets & Search Space: N^LFree
- Entropy in Bits: L × log2(N) and a Rating Table Pro
- Passphrases: Diceware-Style Word Lists & Bits per Word Pro
- Guesses per Second & Time to Crack: Online vs Offline Pro
- Length vs Complexity: An Entropy Grid & Line Chart Pro
- Policy Design: Length, Blocklists & MFA Compared Pro
- Password Reuse: 1 − (1 − p)^N Across Sites Pro
- Lockouts & MFA: Capping Online Guesses Pro