Password Entropy and NIST SP 800-63B-4: What the Numbers Really Mean

Applying Shannon's information measure to a generator that selects every position uniformly and independently gives:

entropy in bits = log2(poolSize ** length)
                = length * log2(poolSize)

The pool size is the number of possible characters at each position. Human choices are not uniformly distributed, so the same expression cannot simply be used as their effective strength.

Moving from 62 to 94 possibilities adds about 0.60 bits per existing position. Doubling a pool from 26 to 52 adds one bit per position. Adding one character contributes log2(N) bits for the current pool N. Which change adds more depends on the current length and pool; neither comparison has one universal winner.

The 94-character model means printable ASCII excluding space. It is not necessarily the set offered by a particular generator. NanToo's actual pool depends on its symbol and exclusion settings.

A bit count cannot establish how many years a password will withstand attack. Online guessing depends on rate limits, additional authentication, monitoring, and other service controls. There is no single guesses-per-second figure applicable to all services.

Offline guessing depends on leaked data, salts, the password-hashing scheme, cost and memory parameters, parallelism, and the attacker's hardware and budget. A fast SHA-256 benchmark or cryptocurrency ASIC rate cannot simply be transferred to password verification.

Use the bit count to compare candidate counts within the same uniform-generation model. It does not certify the security of an account or define a universal safe/unsafe boundary.

A verifier needs an appropriate password-hashing design with salts and cost parameters rather than plaintext storage or an unmodified fast hash. The purpose is to make each offline guess expensive after a leak.

RFC 9106 describes Argon2 and requires conforming interoperable implementations to support Argon2id. Memory, iterations, and parallelism are distinct inputs; a deployment must choose them for its resources and threat model.

A scheme's name alone is not sufficient. Consider parameter choices, implementation quality, salt handling, migration, and the separation of any additional secret key. Strong storage does not make a short or reused password a good choice.

The following is a selective summary of SP 800-63B-4's rules for centrally verified passwords, not local authenticator-unlock secrets.

Mandatory requirements

• At least 15 characters for single-factor authentication; at least eight when used only within MFA.
• No character-type composition rules or routine forced changes; require change when compromise is evidenced.
• No security questions during password selection.
• If Unicode is accepted, verifiers must count each Unicode code point as one character when evaluating length.
• Check the whole proposed password against a blocklist, rather than rejecting arbitrary contained words.
• Allow password managers and autofill; implement rate limiting and appropriate salted password hashing.

Recommendations

Allow a maximum length of at least 64 characters, accept printable ASCII and space as well as Unicode, and permit pasting. For accepted Unicode passwords, NFC normalization before hashing is recommended.

The normative terms matter: SHALL is mandatory, SHOULD is a recommendation, and MAY grants permission. NIST is US technical guidance, not a statement of universal legal obligations for every service or jurisdiction. Read the full specification for deployment requirements.

Diceware uses dice, or an equivalent uniform random process, to select entries from a word list. Five independent rolls of a six-sided die identify one of 6⁵ = 7,776 entries.

With uniform independent selection, one word contributes log2(7776), approximately 12.9 bits. Six words contribute approximately 77.5 bits. A person choosing favorite words or inventing a natural sentence does not meet that model merely because the result has six words.

Check whether the destination service accepts the length and separators. NanToo's password generator selects characters; it does not generate Diceware words or word-based passphrases.

Using distinct random values for different services creates a storage problem. If you use a password manager, evaluate its storage, synchronization, recovery, sharing, and lost-device behavior.

• Use a different value for each service, at a length that the service accepts.
• Choose the manager's own authentication and recovery setup according to that product's requirements.
• Consider MFA, recovery codes, and trusted devices as separate possible failure points.

Copying a generated value also transfers it to the device clipboard. Clearing the page or hiding the result does not necessarily clear that clipboard. Account for the places where the value may remain after it has been moved into storage.

Multifactor authentication uses two or more distinct factor types, such as knowledge, possession, and biometrics. It does not necessarily require a centrally verified password: a cryptographic authenticator activated by a biometric can also supply multiple factors. Resistance still depends on the method. Manually entered TOTP and other OTP values can be relayed through a phishing site.

Cryptographic mechanisms such as WebAuthn can provide phishing resistance when the applicable implementation requirements are met. Synchronization, device binding, key export, and recovery affect the guarantees available.

MFA does not automatically solve password reuse, endpoint compromise, session theft, or attacks on recovery channels. Review what the service actually offers and how access is restored after a failure.

1. Check the destination's length and character constraints; use the single-factor 15-character requirement as the relevant NIST reference where applicable.
2. Use distinct values for different services and a trustworthy storage process.
3. Evaluate the generator's random source, mapping, pool, and length separately.
4. Distinguish MFA options from options that offer phishing resistance.
5. Do not send a real password to an unknown checking website.
6. Change a password when compromise is indicated, rather than relying on routine rotation.
7. Review storage, rate limits, and recovery alongside the generated value.

• Length × log2(pool size) describes uniform, independent generation.
• It does not directly measure a human-chosen password or a fixed cracking time.
• NIST distinguishes mandatory minimum lengths from recommended maximum-length support and other recommendations.
• Generation, storage, authentication, and recovery have separate conditions.
• A password's character types do not establish the security of the whole account.