What constitutes a strong password? An excellent question and
something the industry seems to have difficulties figuring out
at the moment. NIST, the National Institute of Standards and
Technology, has a few words to say on the topic. Basically,
password strength boils down to the number of bits of entropy
that a password has. So the next question is: How does one
calculate the number of bits of entropy of a password? NIST has
proposed the following rules: - The first byte counts as 4 bits.
- The next 7 bytes count as 2 bits each. - The next 12 bytes
count as 1.5 bits each. - Anything beyond that counts as 1 bit
each. - Mixed case + non-alphanumeric = up to 6 extra bits.
After thinking about this for a while and crunching some
numbers, the NIST proposal seemed decent enough. Plus,
implementing the algorithm in software is easy. Unlike a lot of
programmers, I don't take algorithms like this at face value and
just implement them blindly. I like to test their claims first
and sometimes introduce my own ideas. Du