Perplexity vs. Entropy (lockeidentity.com)

Researchers behind Fuzzypass propose replacing naive entropy estimates for passphrases with LLM-based perplexity to better reflect how easily modern AI can guess human-friendly passwords. Classic formulas assume independent random words from a large dictionary, producing astronomically high bit counts for predictable sentences. But deep learning models capture the patterns people use in real language, so a passphrase’s true “search space” is its predictability to an LLM. Fuzzypass therefore computes a passphrase’s perplexity (how surprised a model is by the sequence), scales it down by dividing by two as a safety buffer, and uses that effective per-word search size in the standard log2(dictionary_size^length) entropy formula. The practical impact is dramatic: a nursery-rhyme sentence that naive math rates at ~142.6 bits of entropy drops to about 28.8 bits when measured by Llama 2 7B using Fuzzypass’s method, demonstrating how overconfident traditional calculators can be. This approach makes strength estimates model-aware and actionable for creating memorable yet secure passphrases, but results depend on model capability—larger, stronger LLMs could lower estimated entropy further. Fuzzypass’s implementation highlights the need for threat modeling against contemporary generative models and invites comparisons using bigger models for more conservative assessments.