Password Strength by the Numbers: Entropy, Crack Time & Policy Design

What you'll build

What you will be able to do

Each lab ends with a concrete result that you build yourself and the checker confirms, cell by cell.

• Add up character-set sizes for five password types, compute every search space N^L and see that 12 lowercase letters beat 8 characters from all 95 printable ones.
• Convert search spaces into entropy bits with LOG(N, 2), rate five password types with an approximate VLOOKUP and find the length a random generator needs for 80 bits.
• Size a dice-based word list, compute the bits per word, build an entropy table for 3 to 8 words and find how many words beat 80 bits.
• Compute the average number of guesses for four random passwords and turn them into years under four illustrative attack speeds with one mixed-reference formula, then count the cases that fall within a year.
• Fill an entropy grid for lengths 6–20 and three character sets with one formula, chart it, and measure what adding symbols buys compared with adding characters.
• Compare three password policies for 2,400 staff: minimum random entropy, expected compromised accounts per year with a simple risk model, the risk reduction and the yearly loss avoided.
• Compute the chance that a reused password leaks from at least one of six sites, build a table for 1 to 20 sites, chart it and extend it to several years.
• Compute how many online guesses two lockout policies allow per year, the chance of hitting a 6-digit PIN, the chance of guessing a one-time code before lockout, and the expected takeovers for 120 leaked passwords with MFA.