Password entropy: quantity example
Entropy in bits is the length times the base-2 logarithm of the pool size, when characters are chosen at random. Eight characters drawn from the 94 printable keyboard symbols give 8 × 6.55, or about 52 bits; a passphrase of four random words from a 7,776-word list gives 4 × 12.9, or about 52 bits too. Six random words reach about 78 bits.
Sixteen random lowercase letters give 16 × 4.7, about 75 bits. Every extra bit doubles the number of guesses an attacker needs, and the catch is the word random: a password people invent, such as a name and a year, has far less entropy than its length suggests.
A common misunderstanding
Treating entropy as protection against every kind of attack. It measures resistance to guessing alone, not to a password reused elsewhere and exposed in an unrelated data breach.
Related measurements
Entropy is not the same as complexity rules; a password with an uppercase letter, a digit and a symbol can still be predictable if the pattern is common. Entropy measures unpredictability of the selection process, not appearance. It is different from strength as judged by a meter, which guesses from patterns and dictionaries.
Length matters more than special characters for random selections. Uniqueness matters too: a strong password reused on several sites is only as safe as the weakest of them.
Limits of the definition
The number is only valid if characters are chosen uniformly at random by a machine or dice. Human choices are predictable, so real strength is lower. Attackers use lists of leaked passwords, common patterns and substitutions.
Entropy says nothing about phishing, malware or reuse. Use a password manager, unique passwords and multi-factor authentication. Calculators give an estimate, not a guarantee.
Understanding Password entropy
Entropy is what determines resistance to guessing, not how a password looks to a person: a long password from a small character set can carry more entropy, and take longer to brute-force, than a short one stuffed with symbols, because entropy scales with length far faster than with pool size.
Using Password entropy
Security teams and individuals use it to compare password schemes, to set minimum lengths and to explain why long passphrases are recommended. Password managers generate random strings with high entropy. Calculators estimate entropy from length and character types, giving a rough guide; it helps in choosing between a memorable passphrase and a random string, and in deciding when to require multi-factor authentication.
Password entropy: follow the example through
Assumed example: Entropy in bits is the length times the base-2 logarithm of the pool size, when characters are chosen at random. Eight characters drawn from the 94 printable keyboard symbols give 8 × log₂94, or about 52.44 bits; a passphrase of four independently and uniformly selected words from a 7,776-word list gives 4 × 12.9, or about 52 bits too. Six independently and uniformly selected words reach about 78 bits.
Sixteen random lowercase letters give 16 × 4.7, about 75 bits. Each extra bit doubles this ideal uniform search space; actual attack cost also depends on storage, rate limiting and attacker knowledge, and the catch is the word random: a password people invent, such as a name and a year, has far less entropy than its length suggests.
Password entropy: calculation reference
Entropy (bits) = length × log₂(character-pool size); average crack time = pool size^length ÷ (2 × guesses per second)
| Quantity | Entered or calculated amount | Meaning |
|---|---|---|
| Password length | 14 | Total number of characters in the password. |
| Character set used | Lowercase + uppercase + digits (62) | What kinds of characters the password draws from. |
| Attacker's guessing speed | Offline, fast hash on a GPU (10 billion/sec) | How fast an attacker can try candidate passwords. |
| Entropy | 83.4 | Result under the listed assumptions. |
| Estimated average crack time | 19649417.9 years | Result under the listed assumptions. |
Password Entropy Calculator: change the inputs and compare the resulting cases
How long should a password be?
For random characters, sixteen or more gives a wide safety margin against guessing. For passphrases of random words, five or six words is often recommended. Use a password manager to generate and store them.
Compare entropy figures only against a stated guessing speed, since the same entropy value implies wildly different real-world crack times depending on whether the attacker is rate-limited or running offline hardware.