# Min Password Length vs Block Common Passwords

**URL:** <https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207>\
**Category:** Feature\
**Created:** [2. März 2017 um 04:50 UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207 "2017-03-02T04:50:32Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)\
**Post date:** [2. März 2017 um 22:10 UTC](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207/8 "2017-03-02T22:10:23Z")

</div>

41.36/8 = 5.170; consulting “Entropy per symbol for different symbol sets” table on the [wikipedia password strength page](https://en.wikipedia.org/wiki/Password_strength), I see that’s the value for “Case insensitive alphanumeric”, which is almost certainly not what Discourse is using. I believe 52.56 bits is the correct value for how Discourse treats passwords, and 65.7 is the minimum acceptable amount with a 10 “character” password. That table does not address UTF-8.

---

_[View the full topic](https://meta.discourse.org/t/min-password-length-vs-block-common-passwords/58207)._