Password Entropy Explained: How Strong Is Your Password, Really?

"Use at least one uppercase letter, a number and a symbol" produces passwords like Summer2026! — which satisfies every rule and is cracked in minutes. Password strength isn't about which characters appear; it's about how many guesses an attacker needs. Entropy is the way to count that.

The formula

If a password is chosen uniformly at random from N possible symbols, L times, the number of possible passwords is N^L. Entropy expresses that in bits:

H = L × log₂(N)        bits

12 characters from 94 printable ASCII symbols:
H = 12 × log₂(94) = 12 × 6.555 = 78.7 bits

Every additional bit doubles the search space. On average an attacker finds the password after searching half of it, so the expected work is 2^(H−1) guesses. The symbols don't have to be characters — for a passphrase, N is the number of words in the list and L is the number of words.

Notice that adding a character to the length gains more than adding character classes. Going from lowercase to full ASCII raises bits per symbol from 4.7 to 6.6 (×1.4); going from 12 to 16 characters multiplies total bits by 1.33 — and both together compound.

How long would it take to crack?

Crack time depends on how fast an attacker can test guesses, which depends on how the password was stored. Two reference speeds, for an attacker who has stolen a password database:

• 100 billion guesses/second — a fast, unsalted hash such as MD5 or SHA-1 on a small GPU rig.
• 10,000 guesses/second — a properly tuned slow hash like bcrypt or Argon2id, where each guess is deliberately expensive.

Two lessons stand out. First, how the site stores your password matters as much as the password: the same 8-character password goes from 8.5 hours to nearly ten thousand years. Second, around 75–80 bits a randomly generated secret is out of reach of offline attacks even against fast hashes, with a large margin for faster hardware.

Why your own password has less entropy than you think

The formula assumes every symbol was picked at random. Humans don't do that. Tr0ub4dor&3 is 11 characters from a 94-symbol alphabet — 72 bits by the formula — but it's a dictionary word with predictable substitutions, a capital first letter and a symbol-plus-digit suffix. Cracking tools try exactly those patterns first; the well-known estimate from XKCD #936 puts it at about 28 bits.

Attackers order their guesses by likelihood:

• Passwords from previous breaches — billions of real passwords are public.
• Dictionary words, names, sports teams, dates, keyboard walks (qwerty, 1qaz2wsx).
• Mangling rules: capitalise the first letter, append 1, ! or a year, swap a→@, o→0, e→3.
• Combinations of two or three words.
• Only then, brute force.

Entropy only measures the generator, not the output. A password-strength meter that estimates human-chosen passwords has to model these patterns (Dropbox's open-source zxcvbn is the best-known example). The only way to get the formula's number is to let a random generator choose for you.

Passwords vs passphrases

A passphrase is a sequence of randomly chosen words: amber-quarry-velvet-noted-ripple-anchor. Each word drawn from an N-word list adds log₂(N) bits. With the classic EFF Diceware list (7,776 words — one for each combination of five dice), every word is worth 12.9 bits, so six words give 77.5 bits, on par with a random 12-character password.

Our passphrase generator uses a curated list of 642 short, distinct, easy-to-type words, worth 9.33 bits each. That means you need more of them: 8 words for ~75 bits, 9 words for ~84 bits. The generator shows the exact entropy for whatever settings you choose, so you never have to guess.

Passphrases win when you have to type or remember the secret: your password manager's master password, your laptop login, a disk-encryption passphrase. For everything else, let a password manager generate and store a random 16–20 character password you never see.

How much entropy do you need?

What NIST says now

The 2025 revision of NIST SP 800-63B, the U.S. government's digital identity guideline that much of the industry follows, codified what entropy math has implied for years:

• Passwords used as the only authentication factor must be at least 15 characters; at least 8 when combined with MFA.
• Systems should allow passwords of at least 64 characters and accept all printable characters, including spaces and Unicode.
• No composition rules — don't force a mix of uppercase, digits and symbols.
• No mandatory periodic changes — only force a reset when there's evidence of compromise.
• Check new passwords against a blocklist of breached and common passwords.
• Allow paste and password managers.

Generating strong secrets

Use a cryptographically secure random number generator — in browsers that's crypto.getRandomValues, never Math.random(). And avoid the modulo bias of random() % N, which makes some characters slightly more likely. Our password generator uses the browser's CSPRNG with rejection sampling, so every character is exactly equally likely, and shows the resulting entropy live. Everything is generated locally; nothing is sent or stored.