密码熵值与强度计算：香农信息论与暴力破解深度解析

Password entropy is the foundational metric used in cybersecurity to quantify the uncertainty and strength of an authentication secret. Derived from Claude Shannon’s 1948 information theory, bit entropy (H) measures how many binary guesses an adversary would need in the worst-case exhaustive search scenario. The formula is defined as H = L × log2(R), where L represents the length of the string and R denotes the size of the character pool (e.g., 26 for lowercase, 62 for alphanumeric, 95 for full printable ASCII). Each additional bit of entropy doubles the total number of possible combinations, creating an exponential barrier for brute-force attacks.

// Shannon Entropy Calculation in TypeScript
function calculatePasswordEntropy(password: string): number {
  let poolSize = 0;
  if (/[a-z]/.test(password)) poolSize += 26;
  if (/[A-Z]/.test(password)) poolSize += 26;
  if (/[0-9]/.test(password)) poolSize += 10;
  if (/[^a-zA-Z0-9]/.test(password)) poolSize += 33; // Standard printable symbols

  if (poolSize === 0 || password.length === 0) return 0;
  return Math.round(password.length * Math.log2(poolSize));
}

Modern password cracking utilizes dedicated multi-GPU rigs (such as 8x NVIDIA RTX 4090 clusters) running tools like Hashcat. An 8-GPU rig can compute over 100 billion NTLM or MD5 hashes per second. For weak 8-character alphanumeric passwords (representing 62^8 ≈ 218 trillion combinations), cracking takes less than 35 minutes on consumer-grade hardware. However, increasing length to 16 characters expands the search space to 62^16 ≈ 4.76 × 10^28 combinations, rendering brute-force attacks impossible within human cosmological timescales regardless of computational power.

Traditional password composition rules (requiring uppercase, lowercase, numbers, and symbols) often lead users to predictable substitutions (e.g., replacing "a" with "@" or appending "1!"). These patterns are heavily targeted by rule-based and mask-based cracking dictionaries. In contrast, multi-word passphrases (e.g., "correct-horse-battery-staple") leverage a dictionary pool of 10,000+ common words. A 4-word random passphrase yields (10,000)^4 = 10^16 combinations (~53 bits of pure entropy), while remaining easy for humans to memorize without writing down.

Many online password strength meters transmit user input to remote servers for validation. This introduces massive security vulnerabilities: network interception, server access logs recording plaintext secrets, third-party analytics leaks, and compliance violations. A secure password analyzer must execute 100% client-side inside the browser’s JavaScript V8/SpiderMonkey engine, using the window.crypto API for random generation, ensuring not a single byte ever leaves the user device.