Accessbox · Security
What the bit count means
When Accessbox creates a password, it shows how strong it is, like Strong · 66 bits. That number is the password's bit count, also known as its entropy. It's how Accessbox measures strength. Here's what it means.
What is a bit?
Accessbox builds every password from random choices: which words, which syllables, which characters. Because it made those choices itself, it can count exactly how many different passwords it could have created. The bit count is a short way to write that number.
Each bit doubles it.
| Bits | Possible passwords |
|---|---|
| 10 | about a thousand |
| 20 | about a million |
| 30 | about a billion |
| 40 | about a trillion |
Why a few bits make a big difference
Because every bit doubles the count, the numbers grow fast. A Strong password (64 bits) isn't a little stronger than a Standard one (45 bits). It has about half a million times as many possibilities for an attacker to try.
Standard, Strong and Maximum
| Level | At least | Possible passwords |
|---|---|---|
| Standard | 45 bits | about 35 trillion |
| Strong | 64 bits | about 18 billion billion |
| Maximum | 80 bits | about a trillion trillion |
Standard is the least Accessbox will create. You can choose a higher level in Settings, or when you generate a password for a card.
Why bits and not length?
Length tells you how many characters a password has, not how hard it is to guess. A long password made of predictable pieces can be easier to crack than a short random one. Bits count what an attacker actually has to search through.
That's why Accessbox passwords come in different shapes depending on what a site allows: a phrase of words, syllables, or random characters. They have different lengths but aim for the same strength.
Can I trust the number?
Accessbox only counts choices it made at random, and it rounds down. The number may undersell a password, but it never oversells it.
Why don't some passwords show a bit count?
Accessbox can only count possibilities for passwords it created. For a password you typed or imported, it has no way of knowing how it was chosen. Instead, it checks for shortcuts attackers use. If it finds none, you'll see No known weaknesses found. That isn't a strength rating. It only means Accessbox didn't find an easy way in.
The same applies when a site allows only short passwords and Accessbox can't reach Standard.