In cybersecurity, password strength is not determined by how clever or memorable an acronym seems to a human, but by mathematical entropy—a quantitative measurement of unpredictability expressed in bits. ### The Entropy Formula Information entropy is calculated using the formula: **E = L × log₂(R)** Where: - **L** is the character length of the password. - **R** is the size of the character pool (lowercase = 26, uppercase = 26, digits = 10, special symbols = ~32; combined pool = 94). A 16-character password drawn from a 94-character pool yields over **104 bits of entropy**. At modern brute-force speeds (billions of guesses per second with specialized hardware), testing 2¹⁰⁴ combinations would require trillions of years, rendering brute-force attacks mathematically unfeasible. ### Why Length Beats Character Complexity Adding length exponentially expands the search space far more rapidly than adding isolated symbols to a short 8-character string. An 8-character password with mixed cases and symbols can often be cracked in hours with dictionary hybrid rules. Extending length to 16 or 20 characters raises the permutation count into the sextillions. ### True Cryptographic Randomness Pseudo-random generators relying on basic clocks (`Math.random()`) are deterministic and predictable for dedicated attackers. Zoviva’s Password Generator taps directly into `window.crypto.getRandomValues()`, which draws from operating system hardware noise to generate true cryptographic pseudo-randomness locally in memory.