Password Entropy Explained: How to Measure Password Strength

What is Entropy?

The term entropy comes from information theory, introduced by Claude Shannon in 1948. In this context, entropy quantifies uncertainty or unpredictability. When applied to passwords, it measures how difficult it is for an attacker to guess the correct password by exhaustive search.

The unit is the bit. One bit of entropy means there are two equally likely possibilities. Two bits means four possibilities. Each additional bit doubles the search space. This exponential relationship is what makes longer, more complex passwords so dramatically harder to crack.

See the Wikipedia article on information entropy for a deeper treatment of the mathematical foundations.

The Entropy Formula

For a randomly generated password, the entropy formula is straightforward:

This formula assumes each character is chosen independently and uniformly at random. This is exactly what a good password generator does. Human-created passwords, by contrast, have far lower effective entropy even if they meet the same length and character requirements — because humans are predictable.

Real Calculations with Examples

Let's walk through several real examples to make this concrete.

Example 1: Lowercase Only, 8 Characters

Pool: 26 lowercase letters. Length: 8.

H = 8 × log₂(26) = 8 × 4.70 = 37.6 bits

This is very weak. A modern GPU can exhaust this space in seconds.

Example 2: Lowercase + Uppercase + Digits, 12 Characters

Pool: 26 + 26 + 10 = 62 characters. Length: 12.

H = 12 × log₂(62) = 12 × 5.95 = 71.4 bits

This is reasonably strong for online accounts but may be insufficient for offline cracking scenarios with large compute.

Example 3: Full ASCII, 16 Characters

Pool: 94 printable ASCII characters. Length: 16.

H = 16 × log₂(94) = 16 × 6.55 = 104.8 bits

This is very strong. No realistic attack can crack this in any useful timeframe.

Example 4: Full ASCII, 20 Characters

Pool: 94. Length: 20.

H = 20 × 6.55 = 131 bits

Effectively uncrackable with any foreseeable hardware.

What Different Bit Levels Mean

Entropy (bits)	Security Level	Example	Use Case
0–40	Very Weak	8 lowercase chars	Avoid entirely
40–60	Weak	8-char mixed case	Only low-value accounts
60–80	Moderate	12-char alphanumeric	Acceptable with 2FA
80–100	Strong	14-char full ASCII	General use
100–128	Very Strong	16-char full ASCII	High-value accounts
128+	Extremely Strong	20-char full ASCII	Cryptographic keys, vaults

Cracking Time Estimates

Cracking time depends on the attack scenario: online (rate-limited by the service) or offline (attacker has the hash and unlimited compute). Offline attacks are the worst case.

A high-end GPU cluster circa 2025 can test roughly 10¹² (one trillion) password guesses per second against a fast hash like MD5. Against bcrypt with a cost factor of 12, that rate drops to about 10,000 guesses per second per GPU.

For a password with H bits of entropy, the expected cracking time at R guesses/second is:

t = 2^H-1 / R (on average, the correct password is found halfway through the search space)

At 10¹² guesses/second against MD5:

• 40 bits: 0.0005 seconds (instantaneous)
• 60 bits: 8.7 minutes
• 80 bits: 604,462 years
• 100 bits: 39.6 billion years
• 128 bits: practically infinite

This illustrates why crossing the 80-bit threshold is so significant — and why NIST and security professionals consistently advocate for passwords of at least 12–16 characters from a large character pool.

Entropy vs. Heuristic Strength Meters

Most website password strength meters do not use the entropy formula above. Instead, they use heuristics: checking whether the password contains a dictionary word, whether it has uppercase, whether it has symbols, and assigning points accordingly.

This approach is fundamentally flawed. The password P@ssw0rd1! scores high on character variety heuristics, but an attacker testing rule-based mutations of common passwords will crack it in milliseconds. Its effective entropy is far lower than its apparent complexity suggests.

A true entropy-based measurement ignores content entirely and counts only pool size and length, assuming random selection. This is conservative — it does not give credit for being "almost" random — and that conservatism is the point.

Pool Size vs. Length: Which Contributes More?

Both matter, but length scales better. Adding one character multiplies the total combinations by N (the pool size). Doubling the pool size (from 47 to 94 characters) only adds about 1 bit per character position — the same as adding a single character to the length.

For example, comparing a 12-character lowercase-only password (56.4 bits) with a 16-character lowercase-only password (75.2 bits): adding 4 characters adds about 18.8 bits — the same as tripling the pool size from 26 to about 2,200 characters. Pool tripling simply isn't possible; adding characters is easy.

The practical takeaway: always prioritise length. Adding more characters is more impactful than adding more character types, especially beyond the first few type expansions.

Passphrase Entropy

Passphrases use a different pool: a word list. The Diceware word list contains 7,776 words (6⁵ — five dice rolls). Each word adds log₂(7776) ≈ 12.9 bits of entropy.

• 3 words: 38.7 bits (weak)
• 4 words: 51.7 bits (marginal)
• 5 words: 64.6 bits (moderate)
• 6 words: 77.5 bits (strong)
• 7 words: 90.4 bits (very strong)

The key requirement is that words are chosen truly at random — not selected by a human brain trying to be "random." Human selection introduces bias that reduces effective entropy significantly. Physical dice or a software tool using a cryptographic RNG should be used.

NIST SP 800-63B Reference

The authoritative NIST SP 800-63B Digital Identity Guidelines provides the US government's official guidance on password security. For memorised secrets (passwords), it recommends:

• Minimum length of 8 characters (verifiers should support up to 64 characters)
• Checking passwords against breach databases upon creation
• Not imposing composition rules (mandatory uppercase, symbol, etc.) that produce predictable patterns
• Not requiring periodic password rotation unless compromise is suspected

NIST moved away from prescriptive complexity rules precisely because research showed they reduced effective entropy by pushing users toward predictable patterns. Length and randomness — as captured by the entropy formula — remain the gold standard.