Entropy, explained without the headache
What “bits” means, where the number comes from, and why patterns cost more than they look.
On this page
Password entropy is the scientific measure of password unpredictability. While strength meters often show simplistic ratings, entropy provides a precise mathematical assessment of crack difficulty.
What Exactly Is Entropy?
In information theory, entropy measures uncertainty or randomness. When applied to passwords, it quantifies how many guesses an attacker would need to crack your password through brute force.
Entropy is measured in bits, where each bit represents a doubling of possible combinations under a uniform model. A password with 40 bits of entropy has on the order of one trillion equally likely values (2^40).
Calculating Password Entropy
The formula is: entropy = length × log₂(character set size). For a password using all character types (about 95 characters), each character contributes approximately 6.5 bits of entropy.
- Lowercase only (26 chars): ~4.7 bits per character
- Mixed case (52 chars): ~5.7 bits per character
- With numbers (62 chars): ~6.0 bits per character
- All character types (95 chars): ~6.5 bits per character
Entropy Thresholds
- Below 28 bits: Crackable almost instantly
- 28-35 bits: Vulnerable to determined attackers
- 36-59 bits: Reasonable for low-risk accounts
- 60-80 bits: Strong protection for most purposes
- 128+ bits: Suitable for high-security applications
Random Generation Is Key
The only way to ensure maximum entropy is through truly random password generation. Human-chosen passwords contain psychological patterns that reduce entropy significantly.
Try it: watch the bits change
Opens the generator on Build your own → Characters.