← Entropy Atlas
Secret & unpredictable
Session & bearer tokens
Possession of an unguessable token can grant access without re-entering a password.
Evaluation card
What “plenty” means here.
- Required property
- Enough unpredictability for the number of issued tokens, exposure window, and online or offline guessing surface.
- If it fails
- An attacker guesses a live token or discovers collisions between users.
- Relevant attacker
- Remote clients making guesses, plus observers of logs, URLs, browser storage, or network traffic.
- The Plenty Line
- Use a standard CSPRNG and a generous token space, then combine it with expiry, rate limits, revocation, and safe transport.
- Why more is not automatically better
- A thousand-bit token still fails if copied into logs, leaked by a URL, or accepted forever.
Where it appears
Recognize the pattern.
- 01login sessions
- 02password-reset links
- 03API bearer tokens
- 04CSRF secrets
The Plentropy rule
Protect the requirement, then stop.
Use a standard CSPRNG and a generous token space, then combine it with expiry, rate limits, revocation, and safe transport.
Once that claim has comfortable evidence and margin, improve the next limiting factor instead of worshipping a larger entropy number.