← Entropy Atlas
Secret & unpredictable
Recovery & one-time codes
Short codes trade typing convenience against a smaller guessing space.
Evaluation card
What “plenty” means here.
- Required property
- Uniform generation plus strict limits on attempts, lifetime, and reuse.
- If it fails
- A small code becomes searchable when attempts are unlimited or validation leaks information.
- Relevant attacker
- An online guesser targeting a specific account, or an offline attacker if code verifiers leak.
- The Plenty Line
- Choose the code space together with a concrete attempt budget and expiration window; invalidate after success.
- Why more is not automatically better
- Longer codes can harm usability without fixing missing rate limits or insecure delivery.
Where it appears
Recognize the pattern.
- 01account recovery codes
- 02device pairing codes
- 03email verification codes
The Plentropy rule
Protect the requirement, then stop.
Choose the code space together with a concrete attempt budget and expiration window; invalidate after success.
Once that claim has comfortable evidence and margin, improve the next limiting factor instead of worshipping a larger entropy number.