Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Minimum password length for maximum entropy

Assuming a SHA 256 hash and a completely random password using the extended ASCII charset, is there a specific length after which additional characters offer no increase in entropy, and if so what is this?

Thanks.

like image 699
MichaelRushton Avatar asked Dec 21 '22 17:12

MichaelRushton


1 Answers

SHA-256 has 256 bits, obviously. The minimum UTF-8 character length is one byte, i.e. 8 bits. Therefore, any password longer than 256/8=32 characters is guaranteed extremely likely to collide with a shorter one.

Is this what you meant?

like image 105
Oliver Charlesworth Avatar answered Jan 03 '23 20:01

Oliver Charlesworth