A tweet-thread (X thread?) by @benwr about how many words you need if you want to use the diceware system to create a password that will be safe for 20 years against 1 year of the whole world's password-cracking capacity. He estimates that 11 diceware words suffices. Content replicated below, with minor editing:

If you care about password strength: you want to measure strength in terms of the min-entropy of the randomized method you use to choose. But how much min-entropy should a password have?

Well, I use a password manager to generate and store ~all of my passwords. I don't care how hard they are to memorize, so I generate crazy-long ones. But there's an important exception: The password for my password manager! How strong does that one need to be?

Important questions: "how long do I want to be safe for?" and "safe against what kind of attacker?". But, if you want to ignore this question and be safe anyway, one option is "I want to be safe for 20 years, against one year of the entire world's cracking capacity."

Let's make some crazy-conservative assumptions:

1. A cracking attempt can be done with a single floating-point op
2. N quantum gates can do the equivalent of N^2 floating-point ops worth of password cracking attempts, using Grover's algorithm
3. compute doubles every year

Globally < ~10^24 = 2^80 classical ops/s. Quantum gates is harder to estimate, but I think currently less than 10^8 = 2^27 gates/s. If both double yearly, classical will dominate for about 15 years. But since we want 20 years of security, we care more about quantum.

2^27 gates/s doubled for 20 years gives 2^47 gates/s. pi seconds is a nanocentury: 3.15e7 seconds in a year, so[, since 3.15e7 = 30 * 10^6 = 2^5 * 2^20 = 2^25], 2^25 * 2^47 = 2^72 gates/year. Double that (quantum, remember?) to get 144 bits of cracking capacity. ~11 diceware words. Not impossible to remember!

Estimates of global classical compute:

• How much computing capacity exists in GPUs and TPUs in Q1 2023?, from the AI Impacts Wiki
• Global computing capacity, from AI Impacts

Estimate of global quantum compute is based on this table

plus this estimate of gates/s for a single machine

Compute doubling yearly is a wild and crazy number I made up to be way too fast

Diceware

Addendum: Every additional diceware word you add should increase the timeframe by about 6 years