Password Entropy Explained

Password entropy is a number, measured in bits, that describes how unpredictable a password is. The important word is describes: entropy is a property of the method that produced the password, not of the characters you see. That one idea explains both why entropy is useful and why it can mislead.

Entropy measures the process, not the password

Imagine two people with the password tq7wnb3k. The first got it from a random generator. The second typed it because those keys "looked random". On screen, the passwords are identical. To an attacker who knows how each was made, they are not.

The generated one could have been any of 36^8 (about 2.8 trillion) strings of lowercase letters and digits, each equally likely. The hand-typed one came from a person, and people repeat habits: nearby keys, alternating letters and digits, a digit near the end. An attacker who models those habits searches a much smaller set first.

Entropy, as used in password tools, answers the question: "if the attacker knows exactly how this password was generated, how many possibilities are there?" It assumes the attacker knows the method but not the random choices made. For a good generator, that is a fair and honest assumption.

Bits as a unit of uncertainty

A bit of entropy is the uncertainty of one fair coin flip: two equally likely outcomes. Two bits mean four outcomes, three bits mean eight, and so on. Each additional bit doubles the number of possibilities.

So a password with 40 bits of entropy was chosen from 2^40 (about 1.1 trillion) equally likely options. A password with 41 bits has twice as many. This doubling is why differences that look small in bits are large in practice: 10 extra bits means about 1,000 times more possibilities (2^10 = 1,024).

The idea comes from information theory, where Claude Shannon introduced entropy in 1948 as a measure of uncertainty ^[1]. For a uniform choice, where every option is equally likely, the general definitions simplify to one number: the base-2 logarithm of the number of options. Bonneau calls this measure Hartley entropy and points out that it "measures only the size of a distribution and ignores the probabilities" ^[1]. Keep that sentence in mind; it is the root of every limitation discussed below.

The formula

For a password generated by picking L characters independently and uniformly from a set of N characters, the number of possible passwords is N^L. Entropy is the base-2 logarithm of that number:

H = log2(N^L) = L × log2(N)

N, the character set size, is how many symbols each position can take. Lowercase letters give N = 26. Lowercase, uppercase and digits give N = 62. All 94 printable ASCII characters (excluding space) give N = 94.

L, the length, is the number of positions. Each position adds log2(N) bits: about 4.70 bits for lowercase, 5.95 for alphanumeric, 6.55 for full printable ASCII.

The same logic works for words. A passphrase picks words instead of characters, so N is the size of the word list and L is the number of words. The EFF large word list has 7,776 words, which gives about 12.9 bits per word ^[3].

The whole calculation on one picture - the character set and the length go in, bits come out:

×

Worked examples

Each line is only valid if every character or word was chosen by a secure random process, independently of the others. EFF recommends six words from its large list for about 77 bits ^[3]. Our passphrase generator uses that list, and the password generator uses the browser's cryptographic random number source; How It Works explains the details.

Why length beats character variety

Look at what each change does to the search space.

Adding one character multiplies the number of possible passwords by N. For a 12-character lowercase password, a 13th character makes the space 26 times larger and adds 4.70 bits.

Expanding the character set from 26 to 94 adds log2(94) − log2(26), about 1.85 bits, per character. That is useful, but a 12-character lowercase password with every symbol class added (12 × 6.55 ≈ 78.7 bits) gains less than simply making it 17 lowercase characters long (17 × 4.70 ≈ 79.9 bits).

The reason is mathematical: length is the exponent, character set size is the base. Increasing the exponent usually wins. It also matches how people use passwords: extra lowercase characters or extra words are easier to type, especially on phones, than a mix of symbols. This is consistent with NIST SP 800-63B, which requires a minimum length but prohibits composition rules such as required character types ^[2].

From bits to a crack-time estimate

Entropy becomes more concrete when you turn it into a number of guesses. On average, an attacker searching uniformly random passwords finds the right one after trying half the possibilities, so the average number of guesses is 2^H / 2.

Take the 12-character lowercase password (56.4 bits, about 9.5 × 10^16 possibilities). Using the site's stated assumptions, which are scenarios and not measurements:

• With a fast hash on a GPU rig at an assumed 10^11 guesses per second, the average is about 4.8 × 10^5 seconds, roughly 5.5 days.
• With a slow hash such as bcrypt at an assumed 10^4 guesses per second, the same password needs about 151,000 years on average.

The password did not change; the attacker's speed did. This is why an estimate is always "under these assumptions". How the attacker gets those speeds, and what slows them down, is covered in How Passwords Get Cracked and What Is a Brute-Force Attack?.

The limits of theoretical entropy

The formula assumes uniform random choice

The formula counts possibilities. It gives every possibility the same weight. That is exactly right for a generator that picks each character with equal probability, and it is wrong for almost anything a person chooses.

A person does not pick uniformly from 94^11 strings. They pick a word, capitalise the first letter, add a year and an exclamation mark. The formula does not know that. It sees 11 characters drawn from four character classes and reports a large number.

The "Summer2026!" problem

Summer2026! has 11 characters and contains uppercase, lowercase, digits and a symbol. A calculator that applies the formula with N = 94 reports 11 × 6.55 ≈ 72.1 bits. That would put it in a similar range to a random 6-word passphrase.

In reality, a season plus a year plus ! is one of the first patterns an attacker tries. The true search space for "season, capitalised, recent year, common symbol" is tiny: a few seasons, a few years, a few symbols. The password is guessed early, not after 2^71 attempts.

The formula did not make an arithmetic mistake. It answered a different question: "how many passwords would there be if this one had been generated randomly from 94 characters?" For a human-chosen password, that "if" is false. So the formula result is an upper bound. The real strength can only be the same or lower.

Partial randomness

Some passwords mix random and non-random parts, like a random 8-character string plus 2026. Only the random part counts. The year adds almost nothing, because an attacker who guesses the method also guesses the year. When in doubt, count only the choices made by a secure random process.

Entropy vs guessability

Guessability is how many guesses a realistic attacker needs before trying your password, given what they know about how people choose passwords. For random generated passwords, entropy and guessability agree. For human-chosen passwords, they can be very far apart.

What research shows

Bonneau analysed an anonymised set of almost 70 million Yahoo! passwords in 2012 ^[1]. He argued that traditional metrics like Shannon entropy are inappropriate for human-chosen passwords because they do not model realistic attackers, and that for an attacker guessing individual passwords, Shannon entropy "has no direct correlation to guessing difficulty" ^[1]. Using guessing-based metrics instead, he estimated that the passwords provided fewer than 10 bits of security against an online attack and about 20 bits against an optimal offline dictionary attack ^[1]. Those numbers describe the population, not every user, but they show how wide the gap is.

How zxcvbn-style scoring works

Guess-based estimators take the attacker's view. zxcvbn, described by Daniel Lowe Wheeler in 2016, splits a password into parts it recognises (dictionary words, common passwords, names, dates, keyboard patterns, repeats, sequences) and estimates how many guesses an attacker would need to reach that combination ^[4]. It uses leaked passwords and modern guessing attacks as its benchmark, rather than counting character types ^[4]. Wheeler describes rules based on length, uppercase, digits and symbols (LUDS) as "burdensome and ineffective" ^[4].

That is why the same password can get two very different scores. The entropy calculator says Summer2026! has about 72 bits under the random-generation assumption; a zxcvbn-style checker recognises a word, a year and a common suffix and estimates a small number of guesses. Both outputs are correct for the question each one asks.

Using both numbers

Use entropy when you generate a password: choose a method, length and character set, and the formula tells you exactly how large the search space is. Use a guess-based checker when you want to evaluate a password a person chose, because there the formula can only give an upper bound.

To experiment with N and L, and to see how bits translate into estimated crack times under different attacker assumptions, try the Password Entropy Calculator. To test a password you already have against dictionaries and patterns, use the Password Strength Checker, which runs locally in your browser.