@Tomte, thanks for the comment. I agree with your points and I updated the code today to more prominently reflect the actual entropy in a Diceware password (accounting also for standard diceware word and special chars that are manually added and add less entropy). I am calculating out the full Math.log2() value as well, not using the shorter estimate (e.g. 12.9/word). I also modified the zxcvbn and FAQ text to reflect that zxcvbn is likely overestimating entropy since it is expecting more traditional passwords and is not aware that it is calculating a diceware password. I think it is still helpful to show the zxcvbn output since it, or something like it, is likely to be used to estimate password strength on websites. Thanks for the feedback. Let me know if you have any other comments.
Comments
@Tomte, thanks for the comment. I agree with your points and I updated the code today to more prominently reflect the actual entropy in a Diceware password (accounting also for standard diceware word and special chars that are manually added and add less entropy). I am calculating out the full Math.log2() value as well, not using the shorter estimate (e.g. 12.9/word). I also modified the zxcvbn and FAQ text to reflect that zxcvbn is likely overestimating entropy since it is expecting more traditional passwords and is not aware that it is calculating a diceware password. I think it is still helpful to show the zxcvbn output since it, or something like it, is likely to be used to estimate password strength on websites. Thanks for the feedback. Let me know if you have any other comments.
Cheers,
Glenn