A probabilistic framework for improved password strength metrics

Passwords are still the most widely deployed form of authentication for both local applications and on-line services. For several decades, password policies have aimed at measuring password strength using simple sets of rules in an attempt to guide the users towards the selection of stronger passwords. In this paper, we provide an alternative vision to the existing password strength metrics by proposing a new statistical approach that is better aligned with the actual resistance of passwords to guessing attacks. The proposed probabilistic framework is able to objectively measure the strength of a given password taking advantage of the information available in the several public datasets of passwords.