What a bit of password entropy actually is
Entropy counts the size of the search an attacker faces, on a logarithmic scale. If a generator can produce exactly 260 different passwords and every one of them is equally likely, the password carries 60 bits of entropy, and an attacker who has to try them all has 260 ≈ 1.15 × 1018 candidates. Each extra bit doubles that. This is Shannon's measure, applied to the special case where the distribution is uniform, in which case entropy collapses to the plain logarithm of the number of possibilities.
The word doing the heavy lifting is uniform. Entropy is a property of the process that made the secret, not of the characters in it. The string Tr0ub4dor&3 and the string correcthorse both have a definite number of characters, but neither has an entropy you can read off the page — you can only compute entropy if you know how the string was chosen. Run a password manager set to twelve characters from a 94-symbol alphabet and the answer is exactly 12 × log294 = 78.7 bits. Type something you invented and the honest answer is that no formula on this page applies.
That is why every serious guidance document has moved away from entropy scoring for user-chosen secrets. NIST SP 800-63B dropped composition rules and entropy estimates in favour of a length floor, generous maximum lengths, and screening against lists of previously breached passwords. Entropy remains exactly right for the case it was built for: secrets produced by a random generator, which is what every password manager and every Diceware roll produces.
Once you have the bits, converting to attack time needs one more number — the attacker's guess rate — which is what the password crack time calculator handles. Entropy is the part that depends only on you.
Why the formula is a multiplication of logarithms
Build the keyspace first and take the logarithm second; the formula then explains itself. Each of the L positions can hold any of C symbols independently, so the number of distinct passwords is C multiplied by itself L times: CL. Taking log base two converts a count into bits, and the exponent comes down in front: H = L · log2C.
Written that way, log2C is the entropy each individual symbol contributes, and total entropy is just that per-symbol figure added up L times. The per-symbol values are worth memorising, because they explain every argument about password policy:
- Digits only, C = 10: log210 = 3.32 bits per character.
- Lowercase only, C = 26: 4.70 bits.
- Alphanumeric mixed case, C = 62: 5.95 bits.
- All printable ASCII except space, C = 94: 6.55 bits.
- A Diceware word from a 7,776-entry list, C = 7,776: 12.92 bits.
Two conclusions fall straight out. First, adding character classes is a weak lever: going from lowercase to the full 94-symbol set raises the per-character yield from 4.70 to 6.55 bits, a gain of 39%, and then it is exhausted — there is nothing left to add. Length is the strong lever, because you can pull it repeatedly. Adding four characters to a twelve-character lowercase password adds 4 × 4.70 = 18.8 bits, and you can add four more after that; upgrading that same twelve-character password from lowercase to the full 94-symbol set adds 12 × 1.85 = 22.3 bits once, after which the alphabet lever is spent.
Second, a passphrase is not magic; it is the same formula with a larger alphabet and a smaller L. Six words from a 7,776-word list gives 6 × 12.92 = 77.5 bits, essentially what thirteen mixed-case alphanumeric characters gives (13 × 5.95 = 77.4 bits), and it is far easier to type on a phone. What it must not be is chosen words. The 12.92 bits per word is the entropy of a die roll, not of your taste in vocabulary.
The last term the calculator reports, the length needed for a target, is the same equation rearranged: L = ⌈Htarget ÷ log2C⌉, rounded up because you cannot use two thirds of a character.
Worked example: twelve characters, mixed case and digits
Your password manager is set to generate twelve characters using lowercase, uppercase and digits, and your policy demands 80 bits. Work it through by hand.
- Build the alphabet. 26 lowercase + 26 uppercase + 10 digits = C = 62 symbols.
- Bits per character. log262 = ln 62 ÷ ln 2 = 4.12713 ÷ 0.693147 = 5.9542 bits.
- Total entropy. 12 × 5.9542 = 71.45 bits.
- Keyspace. 6212 = 3.2263 × 1021, which is the same as 271.45. Both ways of writing it describe the same 3.2 sextillion candidates.
- Compare with the target. 71.45 − 80 = −8.55 bits, so this misses the policy by about eight and a half bits — a factor of 375 in search effort.
- Fix it with length. ⌈80 ÷ 5.9542⌉ = ⌈13.44⌉ = 14 characters. Two more characters, and you land at 14 × 5.9542 = 83.36 bits.
- Or fix it with the alphabet. Adding the 32 ASCII symbols takes C to 94 and the per-character yield to 6.5546 bits, giving 12 × 6.5546 = 78.65 bits — still short. The length change works and the alphabet change does not, which is the general pattern.
Now do the same job with words. Six words from the EFF long list: 6 × log27,776 = 6 × 12.9248 = 77.55 bits, still under 80. Seven words gives 90.47 bits and clears it with room to spare. That is why published passphrase advice settles on six to seven words rather than four or five.
How many bits you actually need
The target depends entirely on how the secret is stored, because that determines how fast an attacker can guess. Bits alone mean nothing without a guess rate.
For a secret protected by a modern password hash — bcrypt, scrypt or Argon2 with sensible parameters — the attacker is throttled to something in the thousands or tens of thousands of guesses per second per GPU, and around 60 to 70 bits puts an offline attack out of reach of any budget you are likely to face. For a secret hashed with a fast unsalted function such as MD5, SHA-1 or NTLM, commodity hardware reaches the order of 1010 guesses per second and you want 80 bits or more. For a key that must resist a well-funded adversary for decades, use 128 bits, which is the symmetric security strength NIST SP 800-57 Part 1 treats as adequate beyond 2030.
Three rules of thumb make the number legible. Ten bits is a factor of about a thousand. Twenty bits is a factor of about a million. And every three or four extra bits roughly ten-times the search — precisely, log210 = 3.32 bits per factor of ten. So the difference between a 60-bit and an 80-bit password is a factor of a million in attacker effort, and the difference between 71 bits and 80 bits in the worked example is a factor of 375.
Where entropy stops being the right frame is credential stuffing and phishing. A 128-bit password reused on a site that leaks it is worth nothing, and a 128-bit password typed into a convincing fake login page is worth nothing. Entropy defends against guessing only. That is why NIST SP 800-63B pairs its length requirement with breach-list screening, and why the residual risk belongs in a broader model such as the one behind the annualised loss expectancy calculator rather than in a bit count.
Entropy in bits by length and alphabet
| Length | Digits (10) | Lowercase (26) | Alphanumeric (62) | Full ASCII (94) |
|---|---|---|---|---|
| 6 chars | 19.9 | 28.2 | 35.7 | 39.3 |
| 8 chars | 26.6 | 37.6 | 47.6 | 52.4 |
| 10 chars | 33.2 | 47.0 | 59.5 | 65.5 |
| 12 chars | 39.9 | 56.4 | 71.5 | 78.7 |
| 14 chars | 46.5 | 65.8 | 83.4 | 91.8 |
| 16 chars | 53.2 | 75.2 | 95.3 | 104.9 |
| 20 chars | 66.4 | 94.0 | 119.1 | 131.1 |
| 4 words | 51.7 bits | |||
| 5 words | 64.6 bits | |||
| 6 words | 77.5 bits | |||
| 7 words | 90.5 bits | |||
| 8 words | 103.4 bits | |||
Read down a column to see what length buys and across a row to see what the alphabet buys. The alphabet lever stops at 94 symbols; the length lever does not stop.
This number is an upper bound for anything a person invented
The formula assumes independent uniform draws. Human-chosen passwords violate that assumption comprehensively: they start with a capital, end with a digit and an exclamation mark, use a dictionary word as the stem, and substitute characters in patterns that every cracking rule set already encodes. A password matching the pattern Word1234! nominally scores over 50 bits and falls to a rule-based dictionary attack in seconds. The same applies to substituting @ for a or 3 for e: hashcat has applied those rules by default for years. If the secret was not produced by a random generator, treat the figure above as a ceiling that the real strength sits far below.
Mistakes that inflate the number
- Reading the alphabet off the output instead of the generator. C is the set of symbols the generator could have emitted at each position, not the set that happened to appear. A twelve-character password drawn from a 62-symbol pool still carries 71.45 bits even if no digit turned up in it, and a password containing one exclamation mark is not 94-symbol entropy unless the generator could have put a symbol in every position.
- Counting a capitalised first letter as a full class. Capitalising position one adds exactly one bit, not 26 characters' worth. A deterministic transformation adds nothing at all.
- Counting separators and padding in a passphrase. If you always join words with a hyphen, the hyphens are known to the attacker and contribute zero. Only randomly chosen separators add entropy, and then only log₂ of the number of separators you might have used.
- Using a wordlist size you guessed. Diceware and EFF long lists hold 7,776 entries because they encode five dice; the EFF short list holds 1,296. Using 10,000 as a round number overstates each word by 0.36 bits.
- Assuming your random source is random. Entropy derived from a weak or seeded generator is fiction. Use the operating system's cryptographic source, or physical dice.
- Treating entropy as protection against reuse. Bits defend against guessing only. The same strong password on two sites is one breach away from being worthless on both.
- Comparing bits across storage schemes. Seventy bits behind Argon2 and seventy bits behind unsalted MD5 are the same entropy and wildly different risks, because the attacker's guess rate differs by many orders of magnitude.
Entropy, key strength and where to go next
Password entropy and cryptographic key strength are measured in the same unit and mean the same thing, which makes the comparison useful. A 128-bit AES key has 128 bits of entropy because the key is drawn uniformly at random from 2128 possibilities. A password with 128 bits of entropy is exactly as hard to guess — but only if it is fed to the cipher directly, which it never is. In practice it passes through a key derivation function, and the KDF's cost parameters change the attacker's economics far more than a few extra bits do. The brute-force key search time calculator treats the pure key case, where no KDF slows the attacker down.
The other place these bits show up is the birthday bound. A hash function with an n-bit output resists collisions only to about n/2 bits, because the chance of a coincidence grows with the square of the number of samples — the same arithmetic as the hash collision probability calculator. Entropy has no such penalty: a guessing attack against a 128-bit password really does take 2127 attempts on average, because there is no birthday shortcut when you are searching for one specific value.
For policy work, the practical sequence is: pick the storage scheme first, because it fixes the guess rate; derive the entropy target from that rate and the time you need to hold out; then set a generated length that reaches the target with the alphabet your systems accept. Doing it in that order stops you arguing about symbol requirements, which the arithmetic above shows are worth under two bits per character even in the best case, while length is worth as much as you are willing to type.
Key terms
- Entropy
- For a uniform distribution, log₂ of the number of equally likely outcomes. Measured in bits; each bit doubles the search.
- Keyspace
- The count of possible secrets, CL. Entropy is its base-2 logarithm.
- Diceware
- A method of building passphrases by rolling five dice per word and reading the result from a 7,776-entry list, giving log₂7776 = 12.92 bits per word.
- Security strength
- NIST's term for the number of bits of work an attack requires. A 112-bit or 128-bit strength is the current target for long-lived symmetric secrets.
- Composition rule
- A policy requiring particular character classes. SP 800-63B advises against them because they push users toward predictable patterns that cost less entropy than they appear to add.