What Is Password Entropy? A Plain-English Explanation

Password entropy measures how unpredictable a password is. It is expressed in bits, and each additional bit doubles the number of guesses an attacker would need in the worst case.

The formula

For a password chosen completely at random:

Entropy = length x log2(number of possible characters)

• Lowercase letters only: 26 possibilities, about 4.7 bits per character.
• Upper and lowercase: 52 possibilities, about 5.7 bits per character.
• Letters and digits: 62 possibilities, about 5.95 bits per character.
• Letters, digits and 27 symbols: 89 possibilities, about 6.48 bits per character.

So a random 12-character password using all four sets has about 12 x 6.48 = 78 bits of entropy.

How much entropy is enough?

Our password generator shows the entropy of your settings live, so you can see how length and character types change it.

The important catch

The formula only works when every character is truly random. "Password1!" uses all four character types and is 10 characters long, so the formula claims about 65 bits. In reality it appears near the top of every cracking dictionary and falls in seconds. Human-chosen passwords have far less entropy than their length suggests.

Length beats complexity

Adding one random character from the full set adds about 6.5 bits. Adding symbols to a lowercase-only password raises the per-character value from 4.7 to 6.48 bits. For long passwords, adding length is usually the easier and more effective upgrade, and it keeps passwords compatible with sites that restrict symbols.

Frequently asked questions

How to calculate password entropy?

To calculate password entropy for a random password, multiply its length by log2 of the number of possible characters. A 16-character password from 89 characters has about 16 x 6.48 = 104 bits. Our password strength meter does the maths live.

Is there a password strength checker?

Our generator includes a password strength meter that shows entropy and a crack time estimate for the settings you choose. A password strength checker can only measure randomness it can see; for passwords you invented, assume real strength is lower than any checker reports.

How to check password strength without typing my password into a website?

To check password strength safely, avoid pasting real passwords into unknown websites. Instead, check password strength by its recipe: length, character types and whether it was generated randomly. A random 16-character password with all four types is very strong.