Your favorite passwords have likely already been compromised in a data breach…
As such, creating a strong (high entropy), unique password for each of your online accounts is not just advisable, it’s necessary.
But how do you create strong passwords and manage them all without driving yourself crazy? This blog post and accompanying video will delve into the concept of password entropy and why it’s crucial to cybersecurity.
What Is Password Entropy?
In the context of cybersecurity, entropy refers to the randomness and unpredictability of a password. The higher your password entropy, the harder it is for attackers to guess or crack it.
This makes password entropy a vital factor in strengthening your online defenses.
Not only is password entropy important, but you should be using unique passwords for every website you have an account for.
Indeed, reusing passwords across multiple sites makes you more vulnerable to security breaches because once one site is compromised, and you’re using the same password elsewhere, it puts your other accounts at risk.
Unique passwords for every site ensures that a breach in one of your accounts doesn’t lead to a domino effect across your digital life…
But how do you use complex, high entropy passwords while also remembering all of them?
Use A Password Manager
Given the complexity and the sheer number of unique passwords one must maintain, remembering them all can be daunting.
This is where a password manager becomes invaluable… By using a password manager, you don’t need to remember your account details when using high password entropy.
In a previous video on using Apple Passwords, I described the many benefits of using password managers. If you’re an Apple user, Apple Passwords is an excellent password manager that is integrated into Apple’s hardware and software ecosystem.
As shown in the table below, Apple offers automatic, high password entropy on demand across all your Apple devices.
Other 3rd party password managers – such as 1Password – securely store your passwords and can generate high-entropy passwords for you as well. However, other 3rd party password managers have been hacked, so by using Apple for passwords, that’s one less company I have to worry about in terms of managing my security.
How Fast Can Hackers Crack Your Passwords?
Depending on your password configuration, passwords can be very easy to crack using a “brute force attack”, or “dictionary attack”.
Indeed, free software is available that does this. Products such as “John the Ripper” offer cyber criminals an easy to use tool to crack your passwords. Cracking password is possible with dizzying speed, depending on the level of a password’s entropy.
As you can see below, the longer and more varied your passwords are, the harder they are to crack…
Apple’s default option, an 18 character option, would take over 1 quadrillion years to crack using current software.
It would take the following amounts of time to brute force passwords of varying lengths and complexities.
For example:
- 4-character password using only numbers = cracked “Instantly”.
- 8-character password using numbers, upper and lowercase letters = 3 years to crack.
- 15-character password using numbers, upper and lowercase letters, and symbols = 56 trillion years to crack.
- 18-character passwords using numbers, upper and lowercase letters, as suggested by the Apple Passwords app and iCloud Keychain, would take 2 quadrillion years to crack using a “brute force attack” with today’s technology.
While Apple doesn’t incorporate special characters in its password suggestions by default1, as you can see in the table above2password length and complexity significantly increase the time required for a brute force attack, with longer and more diverse passwords being exponentially more secure.
Software Makes Cybersecurity A Habit
Adopting high entropy passwords and employing a password manager, can provide you peace of mind because you don’t have to worry about password strength or remembering each password.
Password entropy tells you how strong a password is based on how many different combinations a hacker would have to try to guess it… The more random and longer your password is, the higher the entropy—and the more secure it is.
- A password like “123456” has very low entropy—easy to guess.
- A password like “f9K#2pB!7x” has higher entropy—very hard to guess.
As such, use the highest entropy passwords you can as the longer your passwords, with greater randomness included across digits, characters, letters, etc. the harder they are to guess.
Footnotes
- Apple probably chooses to use a greater length password of 18 characters, but no special characters/symbols, because some websites will not accept symbols as valid passwords.
- 2024 password cracking data table from Hive Systems, via Wikipedia.
