Password Security Series

Designing Password Generators with Exact Entropy

In the previous post, we counted the size of a structured password generator exactly. That idea leads to a broader design principle: the best generators are not just random — they are built so their entropy can be computed cleanly in closed form.

Password Series

1 Counting a Structured Password Generator with Combinatorics How to count a constrained password generator exactly and turn the result into measurable entropy. Read article 2 Designing Password Generators with Exact Entropy Why generator formats are easier to trust when their output space can be computed cleanly in closed form. Current article 3 Measuring Password Entropy with Python How to convert password space into bits of entropy and compute that measurement directly in Python. Read article 4 Building a Password Generator in Python with Provable Entropy How to turn the mathematical model into a real generator without losing analyzability or randomness quality. Read article 5 Why Most Password Complexity Rules Fail Mathematically Why legacy complexity rules often overestimate security by ignoring how users actually choose passwords. Read article

Main idea

Good generators are easier to trust when the number of outputs is easy to compute.

Reference model

Diceware works because each word is chosen from a fixed list with a known size.

Design rule

If you can count the output space cleanly, you can compute entropy cleanly.

Closed-form entropy is a design advantage Many generators are strong in practice but hard to analyze exactly. A better design is one where the structure itself makes counting straightforward.

The motivating question

Why Exact Entropy Matters

Many password generators produce strong-looking passwords, but it is often surprisingly hard to say exactly how much entropy they provide.

That is a problem. If we want to reason clearly about security, we should prefer generators whose output space can be counted in closed form.

This is one of the reasons the Diceware method became influential. Each word is chosen from a fixed dictionary, so the total number of possible passphrases is easy to compute.

A clean example

A Readable Word-Based Password Format

Suppose we design passwords like this:

word-word-word

Each word is selected independently from a known dictionary.

Let:

\[ W = \text{number of words in the dictionary} \]

If we choose three words independently, the total number of possible passwords is:

\[ W^3 \]

That is exactly the kind of structure we want: the counting rule is obvious, and the entropy formula follows directly.

Worked example

Using a 2048-Word Dictionary

Suppose the dictionary contains:

\[ W = 2048 \]

Then the total number of passwords is:

\[ 2048^3 \]

Entropy is:

\[ H = \log_2(W^3) \]

Using logarithm rules:

\[ H = 3\log_2(W) \]

Since:

\[ 2048 = 2^{11} \]

we get:

\[ H = 3 \times 11 = 33 \]

So a three-word passphrase from a 2048-word list has 33 bits of entropy.

Improving the design

How to Increase Entropy Without Losing Structure

There are two obvious ways to increase entropy:

• Increase the dictionary size
• Increase the number of words

For example, if we use five words from a 4096-word dictionary:

\[ 4096^5 \]

Since:

\[ 4096 = 2^{12} \]

entropy becomes:

\[ 5 \times 12 = 60 \]

That gives us a much larger search space while preserving the same clean counting structure.

Why this is better

Advantages of Closed-Form Generators

• Entropy is easy to calculate
• Password space is mathematically provable
• The generator can be reasoned about before implementation
• Readable formats remain possible

The larger lesson A password format is not just a user-interface choice. It is a mathematical structure. Good structure makes good analysis possible.

Minimal implementation

A Simple Python Version

import secrets

def generate_passphrase(words, count=3):
    return "-".join(secrets.choice(words) for _ in range(count))

The important part is not the code itself. The important part is that the code matches a model whose output space we can count exactly.

Important distinction A clean implementation does not automatically guarantee strong entropy. The strength comes from the generator design, the dictionary size, and the number of independent choices.

FAQ

Frequently Asked Questions

These are the practical questions that usually come up when designing password generators whose entropy can be computed exactly.

Why is exact entropy better than a password that just “looks random”?

Because appearance is not a measurement. Exact entropy gives you a countable output space and a concrete security estimate instead of a vague impression.

Why is Diceware such a useful reference point?

Diceware is easy to analyze because each word is chosen from a fixed list with known size. That makes both the total search space and the entropy straightforward to compute.

What makes a generator easy to analyze in closed form?

Independent choices, fixed structure, and clearly defined sets. When the format avoids hidden constraints and ambiguous rules, counting becomes much cleaner.

Is a three-word passphrase from a 2048-word list enough?

It gives 33 bits of entropy in this model, which is easy to compute, but whether that is enough depends on your threat model. The main point here is that the strength is measurable, not guessed.

What is the simplest way to increase entropy without making the format messy?

Add more independent selections or use a larger dictionary. Both changes preserve structure while making the search space grow predictably.

Why does the code matter less than the model in this post?

Because the code is only implementing the design. The real security reasoning starts with how many possible outputs the generator can produce and whether that count is easy to verify.

Conclusion

Exact entropy is not just a mathematical luxury. It is a design advantage.

When a generator’s format is clean enough to count directly, its security becomes measurable instead of vague.

The next step is to make that measurement practical: once we know the password space, how do we compute the entropy directly in Python?

Series navigation

Previous: Counting a Structured Password Generator with Combinatorics

Next in the series: Measuring Password Entropy with Python

Raell Dottin