Password Entropy Explained

What entropy means in the context of passwords

Entropy, in information theory, measures the unpredictability of a piece of information. In password security, entropy is the number of bits required to describe how a password was generated, which directly translates to how much work an attacker must do to find it by guessing. More entropy means more work for the attacker. A password with 100 bits of entropy requires 2¹⁰⁰ guesses in the worst case — a number with 31 digits. No computing infrastructure in existence or imaginable in the near future can approach this.

How to calculate password entropy

The formula is simple: entropy (bits) = length × log₂(character set size). If you generate a random password using only lowercase letters (26 characters), each character contributes log₂(26) ≈ 4.7 bits of entropy. A 16-character lowercase password therefore has 16 × 4.7 = 75 bits. Add uppercase (52 options): 16 × log₂(52) ≈ 91 bits. Add digits (62 options): 16 × log₂(62) ≈ 95 bits. Add all standard symbols (95 options): 16 × log₂(95) ≈ 105 bits. The calculation assumes true randomness — a human-chosen password that "looks" complex has far less actual entropy than its character composition would suggest.

Why human-chosen passwords have less entropy than they appear

A password like "P@ssw0rd2026!" appears to use many character types and would score well on a naive strength meter. It has 13 characters using uppercase, lowercase, digits, and symbols. The naive entropy calculation suggests 13 × log₂(95) ≈ 85 bits. The actual entropy is far lower because an attacker does not search randomly through all 95¹³ combinations. They search through dictionary words with common substitutions and patterns. "Password" with letter-to-symbol substitutions and a year appended is one of the first patterns tested in any serious cracking campaign.

This is the fundamental flaw in conventional password strength meters: they measure character composition, not actual unpredictability. A password that contains all required character types but follows a predictable pattern is weak regardless of what the meter says.

How passphrases compare

A diceware passphrase selects random words from a 7,776-word list (six sides of a die, five dice). Each word contributes log₂(7776) ≈ 12.9 bits. A five-word passphrase has about 65 bits. A six-word passphrase has about 77 bits. A seven-word passphrase has about 90 bits. These numbers assume the words are genuinely random — chosen by physical dice or a trusted random source — not selected to be meaningful or memorable through human choice, which dramatically reduces the effective entropy.

The entropy thresholds that matter in practice

Under 40 bits: crackable by any moderately equipped attacker almost instantly. The entire space can be searched in minutes on consumer hardware. 40–60 bits: resistant to online attacks but vulnerable to offline attacks against a stolen hash database if fast hashing is used. 60–80 bits: resistant to offline attacks with current hardware if a slow hashing algorithm is used. Above 80 bits: effectively uncrackable by any realistic attack regardless of hashing algorithm. 100+ bits (achievable with a 16-character random password or 8-word passphrase): theoretical security for any foreseeable future.

What this means for generating passwords

Use a cryptographically secure random generator — not a human brain, which introduces systematic biases that reduce effective entropy. Use at least 16 characters from the full character set (95 options), which gives approximately 105 bits — firmly above any practical attack threshold. Or use a password manager's built-in generator set to maximum length with all character types enabled. The entropy calculation makes clear why length matters more than complexity: each extra character multiplies the search space by the size of the character set, while adding a character type increases entropy by a smaller constant factor.

Turning bits into guessing time

Entropy becomes more concrete when you convert it into time. On average, an attacker finds a randomly generated password after searching half the space — one bit less than its entropy. Assume an illustrative offline rate of 10 billion guesses per second, a plausible order of magnitude for a fast, unsalted hash on GPU hardware; the real figure varies by orders of magnitude with the hashing algorithm, and slow algorithms such as bcrypt and Argon2 cut it dramatically. At that rate a 40-bit password is exhausted in about two minutes, an 8-character random password over all 95 printable characters (about 53 bits) in roughly eight days, and an 80-bit password would take on average around two million years. Every extra bit doubles these figures.

What excluding look-alike characters costs

Many generators offer to exclude ambiguous characters such as 0, O, 1, l and I, which is useful when a password might be read aloud or typed by hand. Removing those five characters shrinks the pool from 95 to 90, so a 16-character password drops from about 105.1 to 103.9 bits — a loss of just over one bit. That is a negligible price for readability, and a single extra character more than makes up for it.