Expectation Entropy as a Password Strength Metric

TL;DR

The paper introduces Expectation entropy as a unified, entropy-style metric to quantify password strength for any random or random-like password on a comparable scale to $H$-estimation tools. It defines $H_E(P)= \frac{\log_2 E(c(P))}{H_0(\mathcal{K})}$ with $E(c(P))= p_{\mathcal{L}} l + p_{\mathcal{U}} u + p_{\mathcal{D}} d + p_{\mathcal{S}} s$ and $H_0(\mathcal{K})=\log_2 |\mathcal{K}|$, where $|\mathcal{K}|=94$, enabling normalization of per-character composition into a $0$ to $1$ (or beyond) scale. Empirical tests on random passwords and public leaks show $H_E$ correlates with password length and composition and yields meaningful intermediate values such as $0.4$ corresponding to 40% of the total guess space. The work offers a practical, interpretable measure of brute-force resistance that complements existing entropy estimators and is particularly relevant for secure IoT provisioning and automatic password generation.

Abstract

The classical combinatorics-based password strength formula provides a result in tens of bits, whereas the NIST Entropy Estimation Suite give a result between 0 and 1 for Min-entropy. In this work, we present a newly developed metric -- Expectation entropy that can be applied to estimate the strength of any random or random-like password. Expectation entropy provides the strength of a password on the same scale as an entropy estimation tool. Having an 'Expectation entropy' of a certain value, for example, 0.4 means that an attacker has to exhaustively search at least 40\% of the total number of guesses to find the password.

Figures (2)

• Figure 1: Comparison of Expectation entropy for randomly generated passwords with different length.
• Figure 2: Comparison of Expectation entropy for leaked passwords.