Password Entropy Explained: The Math Behind Strong Passwords
Password meters, generators, and security articles all talk about “bits of entropy”, usually without saying what the number means or where it comes from. This guide explains it from first principles, shows you how to calculate it yourself, and ends with a practical answer to the question people actually care about: how many bits do I need?
What entropy measures
Entropy measures how many equally likely possibilities a secret was chosen from. It is expressed in bits because each bit doubles the count: a secret with n bits of entropy was picked from 2n possibilities. A coin flip is 1 bit (2 outcomes). A random digit is about 3.32 bits (10 outcomes, and log210 ≈ 3.32). A random 4-digit PIN is about 13.3 bits (10,000 outcomes).
The crucial point is that entropy is a property of how a password was generated, not of the password string itself. The string kT9#mQ2! has about 52 bits of entropy if a program chose each character at random from 88 symbols. If you chose it because it is your old license plate with some symbols added, it has far fewer, because an attacker who knows how people build passwords will try it early.
The formula for random passwords
When every character is chosen independently and uniformly from a set of N characters, a password of length L has NL possible values, so its entropy is:
H = L × log2(N)
Common character sets give these bits per character:
| Character set | Size (N) | Bits per character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase letters | 26 | 4.70 |
| Lower + uppercase | 52 | 5.70 |
| Letters + digits | 62 | 5.95 |
| Letters + digits + 26 symbols (our generator) | 88 | 6.46 |
| All 95 printable ASCII characters | 95 | 6.57 |
Notice how little the character set matters compared with length. Going from letters-and-digits (5.95 bits) to adding symbols (6.46 bits) gains half a bit per character. Adding a single extra character gains about six bits. That is why modern guidance focuses on length rather than on mandatory symbols.
Worked examples
- 12 random lowercase letters: 12 × 4.70 = 56.4 bits.
- 12 random characters from all four types (88): 12 × 6.46 = 77.5 bits.
- 16 random characters from all four types: 16 × 6.46 = 103.4 bits.
- 20 random lowercase letters: 20 × 4.70 = 94.0 bits — stronger than 12 characters with every symbol type.
Passphrases use the same math
A passphrase is a password whose “characters” are whole words. If each word is picked uniformly at random from a list of W words, each word contributes log2(W) bits. The math assumes the attacker knows your word list, which is the safe assumption.
- Our passphrase generator uses a 2,049-word list: log2(2049) ≈ 11.0 bits per word.
- The EFF’s long Diceware list has 7,776 words (65, one per roll of five dice): about 12.9 bits per word.
So 6 words from our list give about 66 bits and 7 words about 77 bits — the same as a 12-character random password with all character types. Separators and capitalization add almost nothing when they are predictable; the strength comes from the number of words. We compare the two approaches in detail in passphrases vs passwords.
Why human-chosen passwords break the formula
The formula only works when each choice is truly random. People are not random. A password like Summer2026! is 11 characters drawn from all four character types, so a naive meter would rate it at around 70 bits. In reality it follows one of the most common patterns there is — a capitalized dictionary word, a year, and a trailing symbol — and cracking tools try such patterns within the first few million guesses. Its effective entropy is closer to 20–25 bits.
This is why the strength numbers shown by our password generator are exact (the password really was chosen at random), while any checker that looks at a password you typed yourself can only estimate. Our strength checker penalizes common substrings, keyboard runs, and repetition for exactly this reason.
From bits to cracking time
On average an attacker searching at random finds the password after trying half of the possibilities, so the expected time is 2H−1 ÷ guess rate. The guess rate depends enormously on how the password is stored and attacked, which our guide on how password cracking works covers in depth. Two reference points:
- Fast hash, offline: about 160 billion guesses per second — roughly what a single high-end consumer GPU achieves against unsalted MD5 in public hashcat benchmarks.
- Slow hash, offline: about 5,700 guesses per second — the same GPU against bcrypt at cost factor 10, a common default.
| Random password | Entropy | Fast hash (MD5) | Slow hash (bcrypt-10) |
|---|---|---|---|
| 8 chars, all types | 51.7 bits | ~3 hours | ~10,000 years |
| 12 chars, lowercase only | 56.4 bits | ~3.5 days | ~270,000 years |
| 12 chars, all types | 77.5 bits | ~21,000 years | effectively never |
| 16 chars, all types | 103.4 bits | effectively never | effectively never |
| 4 words (our list) | 44.0 bits | ~1 minute | ~49 years |
| 7 words (our list) | 77.0 bits | ~15,000 years | effectively never |
These are times for a single GPU. A well-funded attacker with a thousand GPUs divides every number by a thousand, which is why the table’s comfortable margins matter: 77 bits survives a thousandfold speedup with years to spare; 52 bits does not.
How many bits do you need?
- Online accounts with rate limiting (the attacker must guess through the login form): 40–50 bits is already out of reach, but you rarely know how the site stores passwords if it is breached, so aim higher.
- Everyday accounts stored in a password manager: 75–80 bits or more. A 14–16 character random password costs you nothing since you never type it.
- Secrets that protect other secrets (password-manager master password, disk encryption, encrypted backups): 80+ bits, because they can be attacked offline indefinitely. A 7–8 word passphrase is the practical choice when you have to memorize it.
- API keys and tokens: 128 bits or more. Machines remember them, so there is no reason to go shorter. Our random token generator shows the entropy of each token.
How our generators guarantee the math holds
The formula assumes every character is equally likely. A common bug in password generators breaks this: taking a random 32-bit number and reducing it with % N makes the first few characters of the set very slightly more likely whenever 232 is not a multiple of N. The bias is tiny, but it is easy to avoid, so our generators use rejection sampling: random values that fall in the uneven remainder are discarded and redrawn. Every character and every word therefore has exactly the same probability, and the entropy shown is the true entropy.
Key takeaways
- Entropy describes the process that created a password; only randomly generated passwords have a precisely known entropy.
- Length dominates: each extra random character adds about 6 bits; adding symbols to the set adds about half a bit per character.
- Aim for 75–80+ bits for anything that could be attacked offline, and use a password manager so length costs you nothing.