Password entropy explained
Entropy is the correct unit of measurement for password strength. Here is the mathematics from first principles, an annotated reference table, and a live calculator you can use to check any password or passphrase.
What is entropy?
In information theory, entropy measures the expected amount of information (or surprise) in a message. For a password, it measures how unpredictable the string is to an attacker who knows the method used to generate it but not the actual value.
Entropy is expressed in bits. One bit of entropy doubles the number of guesses an attacker must make on average. A password with 80 bits of entropy requires 280 guesses in the worst case — approximately 1.2 × 1024 — before it is found by exhaustive search.
The formula
For a password generated by selecting each character independently and uniformly at random from a set of N possible characters:
entropy (bits) = log₂(N) × length
Where N is the size of the character pool and length is the number of characters.
Examples of pool sizes:
- Lowercase only (a–z): N = 26, log₂(26) ≈ 4.70 bits per character
- Lowercase + uppercase (a–z, A–Z): N = 52, log₂(52) ≈ 5.70 bits per character
- Alphanumeric (a–z, A–Z, 0–9): N = 62, log₂(62) ≈ 5.95 bits per character
- Full ASCII printable (all printable characters): N = 95, log₂(95) ≈ 6.57 bits per character
For a passphrase chosen from a word list of size W, each word contributes log₂(W) bits:
entropy (bits) = log₂(W) × word_count
The EFF Large Wordlist has 7,776 words (log₂(7776) ≈ 12.9 bits per word). The word list used in this site's passphrase generator has 480 words (log₂(480) ≈ 8.9 bits per word). Larger word lists produce stronger passphrases at the same word count.
Reference table
Assuming offline attack at 10 billion guesses per second (a conservative modern GPU cluster):
| Password type | Length | Entropy (bits) | Estimated crack time | Verdict |
|---|---|---|---|---|
| Lowercase only | 8 | 37.6 | 21 seconds | Weak |
| Alphanumeric | 8 | 47.6 | 6 hours | Weak |
| Full ASCII | 10 | 65.7 | 190 years | Moderate |
| Full ASCII | 12 | 78.9 | 2 million years | Strong |
| Full ASCII | 16 | 105.1 | Astronomical | Very strong |
| Passphrase (EFF, 6 words) | — | 77.5 | 701,000 years | Strong |
| Passphrase (EFF, 8 words) | — | 103.3 | Astronomical | Very strong |
| Passphrase (this tool, 9 words) | — | 80.1 | Astronomical | Very strong |
Crack times assume uniform random selection. A password containing a dictionary word, a keyboard pattern, or a memorable substitution (replacing 'a' with '@') will fall orders of magnitude faster because attackers use rule-based cracking.
Live entropy calculator
Paste any password or passphrase to see its estimated entropy. This calculation uses the unique character count as a proxy for pool size — it will overestimate entropy for passwords with patterns. Nothing you type here is sent anywhere.
Entropy estimated from unique character count. Does not detect patterns or dictionary words — a patterned password will appear stronger than it is. Nothing is transmitted.
Putting it in context: attack scenarios
Entropy figures are only meaningful relative to an attack model. The scenarios below represent the main threat categories:
Online guessing (rate-limited)
Most online services lock an account or impose delays after a few failed login attempts. At 10 guesses per second, even a 40-bit password would take 3,500 years. A 12-character random password is beyond any practical online attack. The risk here is not brute force — it is reuse, phishing, or credential stuffing from a breach database.
Offline attack against a leaked hash
When a service is breached and password hashes are stolen, an attacker can test guesses offline with no rate limiting. Speeds vary by hash algorithm: MD5 can be cracked at over 100 billion guesses per second; bcrypt at cost=12 allows only about 1,000 per second. For bcrypt, even a 60-bit password would take 36,000 years. For MD5, you need 80+ bits to be safe.
This is why the hash algorithm matters as much as the password length — but you cannot control what algorithm a service uses. Therefore, using unique passwords for every account limits the blast radius of any single breach.
Passphrase versus random password
A random password from the full ASCII set packs about 6.57 bits per character. A passphrase from a 7,776-word list packs about 12.9 bits per word. For the same number of characters, the random password wins decisively. But words are much easier to remember and type accurately — so for a master password that must be memorised, a 9-word passphrase (roughly 116 bits from the EFF list) is a practical and very strong choice.