密码强度与熵：为什么长度赢过花样

Password advice is full of folklore. The measurable truth is one number: entropy in bits. Understanding it explains why a short symbol-studded password can lose to four random words — and why length quietly dominates.

Entropy: the count of possibilities

Each character drawn randomly from N options adds log2(N) bits. Lowercase letters add about 4.7 bits per character, full printable sets about 6.5. A 16-character random password from the full set carries roughly 100 bits — beyond any brute force budget on Earth.

Length beats complexity

A 20-character lowercase password (~95 bits) beats an 8-character symbol-laden one (~52 bits). Adding patterns adds nothing when the guesser knows the pattern; only randomness adds entropy.

Crack-time reality check

Password	Entropy	Offline crack (GPU rig)
8 chars, lowercase	~37 bits	seconds
8 chars, full set	~52 bits	weeks
16 chars, full set	~103 bits	centuries+
4 random words	~50 bits	months

For anything real, generate 16-24 characters with the Password Generator — it uses the browser cryptographic RNG and never transmits results.

Why reuse is the bigger risk

Most account takeovers come from leaked password databases elsewhere, not brute force. A unique high-entropy password per site caps the blast radius; pair it with hashing hygiene — a system that hashes passwords with plain SHA-256 instead of a slow KDF is doing it wrong, as the hash guide explains.