I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from xkcd.
- According to xkcd (https://xkcd.com/936/)
Tr0ub4dor&3 ~28 correcthorsebatterystaple ~44 - KeePassXC (https://github.com/keepassxreboot/keepassxc)
Tr0ub4dor&3 46.74 correcthorsebatterystaple 47.43 - Password Entropy Calculator (https://alecmccutcheon.github.io/Password-Entropy-Calculator/)
Tr0ub4dor&3 ShannonEntropyBits: 36.05 TrigraphEntropyBits: 71.96 correcthorsebatterystaple ShannonEntropyBits: 84.10 TrigraphEntropyBits: 110.74 - Password Quality Calculator (https://eyhn.github.io/PasswordQualityCalculator/)
Tr0ub4dor&3 63 correcthorsebatterystaple 92 - omnicalculator (https://www.omnicalculator.com/other/password-entropy)
Tr0ub4dor&3 Lower Latin 6 Upper Latin 1 Digits 3 Special 1 72.1 correcthorsebatterystaple Lower Latin 25 Upper Latin 0 Digits 0 Special 0 117.5 Not only did the numbers vary, the degree of difference between the two also fluctuated. KeePassXC caught my eye as it suggested that the two passwords were on par with each other. Why the difference? Are there more metrics then H = 1og 2 N^L ?
entropy of passwordfrom the perspective of a motivated attacker, whose knowledge of the "process" that counts, not so much the password itself.