Understanding password entropy: the mathematics of strong passwords

What entropy is

In information theory, entropy measures the expected amount of information (or surprise) in a randomly chosen value. When applied to passwords, it answers: if an attacker knows exactly how you generated a password but not the specific result, how many guesses would they need on average to find it?

The answer is expressed in bits. A password with N bits of entropy requires 2^N guesses in the worst case. Each additional bit of entropy exactly doubles the attacker's workload. This is why entropy is a better measure than "has uppercase letters" or "contains a symbol" — it is a single number that captures the full difficulty of the search problem.

Two things determine entropy for a randomly generated password:

• Pool size — the number of distinct characters available at each position
• Length — the number of positions

The calculation

For a password where each character is chosen independently and uniformly from a pool of N characters:

entropy (bits) = log₂(N) × length

Worked examples using common pool sizes:

Pool	N	Bits per char	12 chars	16 chars
Lowercase a–z	26	4.70	56.5	75.3
Alphanumeric	62	5.95	71.5	95.3
Full ASCII printable	95	6.57	78.8	105.1

The same formula applies to any independently and uniformly drawn character set. The independence requirement is critical: a password generated by a human using a pattern, rule, or memorable structure will have far lower effective entropy than the formula predicts.

Pool size versus length: which matters more?

The relationship is not symmetric. Consider the effect of expanding the pool from lowercase-only (26) to full ASCII (95):

• Bits per character increases from 4.70 to 6.57 — a gain of 1.87 bits per character.
• At 12 characters, this adds 22.4 bits. Significant, but achievable by adding 3-4 more lowercase-only characters.

Now consider the effect of adding one more character to a full-ASCII password:

• One character adds 6.57 bits — more than the pool expansion contributed per character.

The conclusion is not that pool size is irrelevant — it matters, especially in helping defeat rule-based cracking — but that length is the more powerful lever at equal effort. When your password manager allows 64 characters, use 20-24, not 10 with complex symbols.

The most common password-strength mistake is adding complexity rules while accepting short lengths. A 10-character password with full ASCII has 65.7 bits. A 16-character lowercase-only random password has 75.3 bits. The longer, simpler password is stronger.

Where passphrases fit

A passphrase is a sequence of words drawn randomly from a word list. The formula is the same, applied at the word level:

entropy (bits) = log₂(word_list_size) × word_count

The EFF Large Word List has 7,776 words. Each word contributes log₂(7776) ≈ 12.9 bits of entropy. A 6-word passphrase from this list: 6 × 12.9 = 77.5 bits — comparable to a 12-character full-ASCII random password.

The word list used in this site's generator contains 480 words (log₂(480) ≈ 8.9 bits per word). A 9-word passphrase: 9 × 8.9 = 80.1 bits. Adequate for most purposes, and memorisable.

The trade-off is character count versus memorability. A passphrase is longer to type but easier to remember without writing down — which makes it well-suited for a master password that cannot be stored in the manager itself.

Putting entropy in context: attack scenarios

An entropy figure is only meaningful relative to what an attacker can actually do. The two main scenarios differ by orders of magnitude:

Online attacks (rate-limited)

A service that enforces account lockout after 10 failed attempts effectively caps guessing at a trivial rate. Any password with more than about 35 bits of entropy is beyond practical online guessing. The threat here is not brute force — it is credential stuffing (reused passwords from breaches), phishing, and social engineering.

Offline attacks against leaked hashes

When a service is breached and password hashes are stolen, an attacker with GPU hardware can attempt billions or trillions of guesses per second, depending on the hash algorithm:

• MD5 — 100+ billion guesses/second. A 60-bit password falls in about 17 minutes.
• bcrypt (cost 12) — ~1,000 guesses/second. A 60-bit password would take longer than the age of the universe.
• Argon2id — similar to or slower than bcrypt at typical settings.

You cannot control which algorithm a service uses. Therefore, using unique passwords per account — so that any single breach affects only one account — is more important than optimising entropy for the worst-case hash algorithm.

Practical guidance

Applying these principles to actual password choices:

• For routine accounts managed in a password manager: use a 16-character fully random password (105 bits). This is comfortable to generate and save, and exceeds any foreseeable cracking capability.
• For a master password you must memorise: use a 9-word passphrase from a large word list (90-116 bits, depending on list size). Write it down and store it securely until memorised.
• For high-value accounts (email, bank, cloud storage): add a hardware FIDO2 key. No password entropy figure protects against phishing; only domain-bound authentication does.
• For password generation, use only a cryptographically secure random source. This site uses window.crypto.getRandomValues(). Avoid passwords generated by tools that rely on Math.random(), which is not suitable for security applications.