--- title: "Passwords: why length beats complexity" description: "Real vs nominal entropy, the NIST legacy, the famous passphrase comic, and why picking your own words destroys the uniform distribution the panel assumes." date: 2026-07-19 locale: en url: https://escribano.dev/en/blog/010-password-entropy-length/ --- I'm a fan of [xkcd](https://xkcd.com/), and one of its most quoted strips is [the password panel (#936)](https://xkcd.com/936/): `Tr0ub4dor&3` versus `correct horse battery staple`. It changed how millions of people think about passwords. The message seems clear: forget the "complex" password, use four common words, and win on both security and memory. The detail almost nobody reads is the adjective: **random**. Four words you pick are not four random words. The frame I care about: why inherited complexity rules fail, why the comic only works under specific assumptions, and what that means when language biases the initial letters of the words you memorize. ## The comic is right… with dice The bottom panel of xkcd assigns 11 bits per word to `correct horse battery staple`. That assumes uniform selection from a dictionary of about 2,048 common words ($2^{11}$). Four independent random words add up to ~44 bits, about 550 years at 1,000 guesses per second in the comic's scenario. That model is **Diceware**: roll dice, look up a list, repeat. Implementations like [diceware.dmuth.org](https://diceware.dmuth.org/) bring it to the browser with `crypto.getRandomValues()` (the passphrase is generated locally and never leaves your machine). The passphrase is memorable *after* being generated at random, not *because* you invented it. If you truly pick four words at random from a large list, the comic is correct. The problem is almost nobody does that. ## The comic fails… without dice When you choose the words to remember them, you no longer have 11 bits per word. You have something much worse: | Bias | What happens | |------|----------------| | **Lexical frequency** | You pick `house`, `dog`, `love` before `yurt` or `yak` | | **Initial letter** | English has far more words starting with `c`, `p`, `s` than `x`, `z`, `q` | | **Semantics** | Phrases that "tell a story" shrink the search space | | **Personal** | Names, dates, songs, pets, attackers try those first too | The simplified formula $H = L \cdot \log_{2}(N)$ only holds when each symbol has uniform probability $1/N$. If you choose the words, the effective $N$ per position is much smaller, and not the same for every letter. Imagine deriving a password from the initials of twenty words you memorized: - With a uniform 26-letter alphabet: $20 \cdot \log_{2}(26) \approx 94$ nominal bits. - If your words mostly start with `c`, `h`, `p`, `s`, `t`, real entropy per position is closer to $\log_{2}(5\text{–}8)$ than $\log_{2}(26)$. An attacker with an enriched dictionary does not try all combinations with equal priority. They try what humans choose first. ## Entropy in five minutes Shannon entropy measures uncertainty in a choice:

H = −∑_i p_i log₂ p_i

If each symbol is equally likely among $N$ options, this simplifies to $H = \log_{2}(N)$. For a sequence of length $L$ with independent symbols:

H_total = L · log₂ N

| Password | Calculation | Approx. entropy | |----------|-------------|-----------------| | 20 random lowercase letters | $20 \cdot \log_{2}(26)$ | ~94 bits | | 16 random lowercase letters | $16 \cdot \log_{2}(26)$ | ~75 bits | | 12 "complex" chars (~94 symbols) | $12 \cdot \log_{2}(94)$ | ~79 bits | | 4 truly random words (Diceware) | $4 \times 11$ | ~44 bits | | 4 words you choose | human distribution | hard to quantify; often < 30 bits | | 8 chars meeting minimum rules (`Summer2024!`) | human pattern | ~30–40 bits | Length beats a "rich" alphabet when randomness is real. But without randomness, neither length nor alphabet saves you. ## Two sides of the same mistake | Approach | Symptom | Illusion | |----------|---------|----------| | **NIST complexity** | `Summer2024!`, `Password1!` | "Has uppercase, number, and symbol" | | **xkcd misapplied** | `house dog love moon` | "Four words, like the comic" | | **Leetspeak** | `P@ssw0rd`, `Tr0ub4dor` | "Symbols confuse the attacker" | In all three cases nominal entropy looks reasonable. Effective entropy is low because generation is human, predictable, and exploitable with substitution rules. ## Where the rules came from Policies requiring "at least one uppercase, one number, and one symbol" trace to [NIST SP 800-63](https://pages.nist.gov/800-63-3/) (2003), associated with Bill Burr. The intent was to enlarge the search space. In practice, it trained people to produce recognizable patterns. In 2017, Burr publicly acknowledged those guidelines had worsened effective security. The updated [SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html) recommends length, breached-password lists, password managers, and 2FA, not mandatory periodic rotation or ritual complexity. xkcd's closing line makes the same diagnosis from another angle: twenty years teaching passwords that are hard for humans to remember and easy for computers to guess. ## The cost of typing complexity Beyond entropy, there is usability. On a QWERTY keyboard, `Shift` and symbol keys increase typos, retries, and the temptation to reuse the same "hard" password everywhere. Each uppercase letter is an extra keystroke. On mobile it is worse: you switch layers or long-press to move between cases, and a password that mixes both becomes slow and awkward to type with your thumb. If you enter that key often (laptop boot, vault unlock) you pay that cost every day. Oral transmission matters too. Dictating `Tr0ub4dor&3` forces you to clarify "that's uppercase", "zero, not letter O", "at sign, not a". An all-lowercase string reads straight through: "jay, en, ar, a…" without ambiguity. Useful when someone you trust helps recover a backup or when you rehearse the password out loud while memorizing it. A long random lowercase string (generated by a manager) is faster to type, less error-prone, and clearer to dictate than a short password with complexity rules. ## Modern cracking and AI-assisted attacks Current attacks do not only try `password` and `123456`. They use substitution rules (`a→@`, `e→3`, `s→$`), enriched dictionaries with proper names, and models that learn human patterns (PassGAN and similar). "Disguised" passwords and "creative" phrases are the first candidates, not the last. AI does not break cryptography; it exploits that humans are not randomness sources. ## Required caveats - Real Diceware and truly random passphrases work. The problem is not words; it is non-random choice. - **Entropy is not everything.** Credential stuffing, phishing, leaks, and reuse can compromise a strong password without guessing it. - **Site limits.** Some cap length or reject certain symbols, another argument for long simple letter sequences. ## What to do in practice 1. **Password manager** for almost everything. One strong master password; the manager generates the rest. 2. **CSPRNG generation**: never improvise. 3. **Adequate length**: ~18–20 random characters give ~75–94 bits with lowercase; enough for most contexts. 4. **2FA** where it matters, TOTP, hardware keys, WebAuthn. 5. **Diceware** if you want words and have dice (or a reliable generator like [diceware.dmuth.org](https://diceware.dmuth.org/)). In the [RPS framework](/blog/002-rps-principle/), this is conscious stone for day-to-day use: little ritual, maximum reversibility toward a manager, bounded cost of failure if the master password is strong. ## Closing: random first Complexity rules and the xkcd comic point in opposite directions, but they share an invisible requirement: randomness must be real. Without it, the comic's math lies and NIST's rules make things worse. The practical question that remains: if you need to memorize a few critical passwords (the manager's master key, laptop boot) without choosing the words or letters yourself, how do you do it without falling into the bias we just described? In the [next post](/blog/011-tales-vault-system/) I introduce **[`tale`](https://github.com/escribanoruben/tale)** (Tales Vault System): entropy first, story second.