Entropy-Based Analysis of Password Strength and the Effect of Human Password Patterns

This study presents an entropy-based analysis of password strength and investigates the impact of real-world human password patterns on the accuracy of theoretical security models. Password-based authentication remains one of the most widely used security mechanisms in modern digital systems; however, its effectiveness is often reduced due to predictable user behavior in password creation. The paper applies Shannon’s information theory to evaluate password strength based on length and character set complexity. It further examines how commonly observed human patterns—such as dictionary words, name-based passwords, keyboard sequences, and simple numeric additions—affect the actual security strength of passwords compared to theoretical entropy estimates. A structured evaluation framework is used to compare theoretical password entropy with real-world usage patterns, highlighting the gap between mathematical models and human behavior. The findings suggest that while entropy provides a useful theoretical measure of randomness, it does not fully capture practical password security due to predictable user tendencies. This work emphasizes the importance of combining entropy-based evaluation with behavioral pattern analysis to improve password strength assessment in authentication systems.