What Is Password Entropy? A Simple Explanation
Entropy in Plain English
Entropy is a measure of randomness. In the context of passwords, it tells you how many possible combinations an attacker would need to try to guess your password by brute force.
Higher entropy = more combinations = harder to crack.
Entropy is measured in bits. Each bit doubles the number of possible combinations.
How Entropy Is Calculated
The formula is simple:
Entropy = Length x log2(Pool Size)
- Length is the number of characters in your password
- Pool Size is the number of possible characters for each position
For example, a 12-character password using lowercase letters only:
- Pool size: 26 (a-z)
- Entropy: 12 x log2(26) = 12 x 4.7 = 56.4 bits
A 12-character password using lowercase, uppercase, digits, and symbols:
- Pool size: 95 (26 + 26 + 10 + 33)
- Entropy: 12 x log2(95) = 12 x 6.57 = 78.8 bits
Same length, but 22 more bits of entropy just from using a larger character set.
What Do the Numbers Mean?
| Entropy | Strength | Crack Time (10B guesses/sec) |
|---|---|---|
| < 28 bits | Weak | Instantly |
| 28-36 bits | Fair | Minutes to hours |
| 36-60 bits | Good | Days to years |
| 60-80 bits | Strong | Centuries |
| 80+ bits | Excellent | Longer than the universe |
Our strength meter calculates entropy in real-time as you generate or check a password.
Why Randomness Matters More Than Patterns
The entropy formula assumes each character is chosen completely at random. If you use a pattern (like a word, a date, or a keyboard sequence), the actual entropy is much lower than the formula suggests.
For example, "Password123!" has a calculated entropy of about 79 bits (12 chars, mixed types). But attackers do not try every combination in order. They try common patterns first. "Password123!" would be cracked in seconds because it follows an extremely common pattern.
True randomness is what makes entropy real. Use a generator that picks characters randomly, not a pattern you invented.
Passphrase Entropy
Passphrases calculate entropy differently:
Entropy = Word Count x log2(Wordlist Size)
Using the EFF diceware list (7,776 words):
- 4 words: 4 x 12.9 = 51.7 bits
- 5 words: 5 x 12.9 = 64.6 bits
- 6 words: 6 x 12.9 = 77.5 bits
Additional options add entropy:
- Capitalizing words: +1 bit per word
- Adding a number: +3.3 bits (digit) + position entropy
The Bottom Line
You do not need to calculate entropy yourself. Our tool does it for you. But understanding it helps you make better choices:
- Longer is always better (each character adds ~4-6 bits)
- More character types is better (expands the pool)
- True randomness is essential (patterns kill entropy)
- 80+ bits is the goal for important accounts
Need a strong password?
Generate One Free