Home · Blog · Password entropy
Password entropy, explained without the maths degree
10 Oct 2026 · Security · 7 min read
Open any password generator and you'll see a number next to the result: "96 bits of entropy", maybe with a reassuring label like Strong. It's worth knowing what that number is actually counting — and what it politely leaves out.
It's a measure of the haystack, not the needle
Entropy measures the size of the search space: how many guesses an attacker would need, on average, to stumble on your password if they knew exactly how it was made. A 20-character password drawn from 94 possible characters has about 131 bits of entropy, which means roughly 2131 possibilities. That's the haystack. The number says nothing about where in the haystack your needle sits — that's what the randomness is for.
Length beats cleverness, every time
Each extra character multiplies the search space by the size of the character set. Going from 12 to 16 characters with the same character set multiplies the possibilities by 944 — about 78 million times over. Swapping a few letters for symbols, the classic p@ssw0rd trick, adds far less than people think, because attackers have seen that trick too. If you remember one rule: when in doubt, make it longer, not weirder.
The assumption nobody mentions
Every entropy figure assumes the attacker knows the recipe but not the result. That's the correct assumption for math, but real attacks rarely work that way. Nobody brute-forces a 20-character random password; they phish it, find it reused from a breached site, or read it off a sticky note. Entropy describes resistance to guessing. It says nothing about resistance to theft — which is where most passwords actually die.
What to actually do
- Generate passwords randomly (that's what the Password Generator is for) instead of inventing them — human-invented passwords are far more predictable than they feel.
- Prefer length: 16+ characters for anything important.
- Never reuse a password across sites; a breach anywhere becomes a breach everywhere.
- Store them in a password manager rather than your memory or a notes file.
The entropy number is a useful compass, not a certificate. It tells you the password can be strong. Keeping it secret is what makes it strong.
The entropy formula, in plain words
The formula is simpler than the word "entropy" suggests. Take the number of characters in the password, and multiply by how much uncertainty each position carries: entropy = length × log2(pool size). The pool is how many different characters any one position could be — 26 for lowercase letters alone, 52 once you add uppercase, 62 with digits, and 94 with the usual symbols. The logarithm just converts that pool into bits: log2(94) is about 6.55, so every character drawn from the full keyboard contributes roughly six and a half bits.
Two consequences fall straight out of that multiplication. First, length and pool size are equals in the formula — one more character is worth exactly as much as making the pool 94 times bigger, because both multiply the search space the same way. Second, the formula only works if every character is actually unpredictable. If your password is a name with a year after it, the real pool isn't 94 characters per position; it's the few thousand first names times the few dozen years people pick. The formula is honest, but only about truly random input.
What different passwords actually score
Applying the formula to a few familiar patterns shows how wide the range is:
| Pattern | How it's built | Entropy |
|---|---|---|
password123 | Human-chosen, in every breach list | ~10 bits against real attackers |
| 8 random lowercase letters | 8 × log2(26) | 38 bits |
| 4 random words from a 2,000-word list | 4 × log2(2000) | 44 bits |
| 8 random characters, full keyboard | 8 × log2(94) | 52 bits |
| 12 random characters, full keyboard | 12 × log2(94) | 79 bits |
| 16 random characters, full keyboard | 16 × log2(94) | 105 bits |
The first row deserves a pause. A breached-list password doesn't have 38 or 52 bits in practice — it has whatever entropy remains after the attacker checks the millions of passwords everyone else already chose, which is essentially nothing. This is the gap between the entropy of the recipe and the entropy of the actual human output. The table's other rows assume a proper random generator, where every possibility in the pool is equally likely.
How long would that actually take to crack?
Bits are abstract, so translate them into time. On average an attacker needs half the search space — 2entropy−1 guesses. The speed depends entirely on where the guessing happens:
- Offline attack (the attacker stole the password database and guesses on their own hardware): a modern setup can try roughly ten billion guesses per second against a fast hash. At that speed, 38 bits falls in seconds, 44 bits in about fifteen minutes, and 52 bits in a few days. But 79 bits takes on the order of a million years, and 105 bits is beyond any hardware that will ever exist.
- Online attack (guessing against the live login page, which rate-limits attempts): even a generous ten guesses per second makes 38 bits take centuries and 44 bits take tens of thousands of years. This is why short PINs survive online but die instantly offline — and why every service you use should be rate-limiting logins.
The practical line sits somewhere around 70–80 bits for anything that might ever be attacked offline: past that point, guessing simply isn't the way in, and attackers move on to phishing, malware, or reusing your password from a breached site. Entropy buys you a margin of safety against hardware getting faster; a 79-bit password today will still be uncrackable when GPUs are a hundred times quicker.
The entropy vs memorability tradeoff
Here is the honest tension: the passwords with the best entropy are the ones no human can remember. Sixteen random characters from the full keyboard give you 105 bits and zero chance of typing them correctly twice. So people either write them down insecurely, reuse them, or weaken them to something memorable — and each of those reactions destroys more security than the missing bits ever provided.
The way out is to stop memorising passwords at all. A password manager holds the random 105-bit strings so your memory doesn't have to, and you memorise exactly one strong secret: the manager's master password or passphrase. That one secret is where memorability genuinely matters, and it's where a long passphrase earns its keep — four or five random words give you 44–55 bits in something you can actually hold in your head, which is plenty for a secret that can only be attacked at the speed of you typing it (plus whatever protections the manager adds).
Muscle memory counts as memorability too. A random string you type forty times a week becomes typable even if it never becomes memorable, which is why some people keep one long random password for their computer login and let the manager handle everything else. There is no single right answer — the principle is to spend your limited human memory budget on one or two secrets and generate the rest.
The honest caveat: entropy is a model, not a guarantee
Every entropy figure you've read here carries fine print. It assumes the password was generated randomly from the stated pool — feed it a human's "random" choices and the real entropy is far lower, because humans cluster around the same patterns. It assumes the attacker knows the recipe; against targeted guessing that exploits your personal details (pet names, dates, team names), the effective search space shrinks dramatically. And it says nothing about the thousand ways passwords leak that have nothing to do with guessing: phishing pages, keyloggers, shoulder surfing, databases stored in plain text, session cookies stolen from your browser.
Think of entropy as a necessary condition, not a sufficient one. A password with 20 bits was weak before you typed it; a password with 105 bits is strong only against guessing. The rest of the job — uniqueness per site, safe storage, phishing resistance — is outside the formula's reach. Strength meters score the needle's haystack. You still have to guard the needle.