What is Entropy?
In physics, entropy is a measure of disorder or randomness in a system. In information theory (the math that powers computer science), entropy is a measure of unpredictability.
When we apply this to passwords, entropy measures how difficult it is for an attacker—specifically a computer running a brute-force algorithm—to guess your password without any prior knowledge. The higher the entropy, the more "random" the password appears to the computer, and the longer it takes to guess.
Entropy is measured in bits. Each additional bit of entropy doubles the number of possible guesses an attacker must make.
The Mathematics of Guessing
To calculate the entropy of a password, we need two variables:
- Length (L): The number of characters in the password.
- Pool Size (R): The number of possible characters the password could be drawing from.
The standard character pools are:
- Lowercase letters (a-z): 26
- Uppercase letters (A-Z): 26
- Numbers (0-9): 10
- Standard Symbols (!@#$%, etc.): roughly 32
If you use a password that contains uppercase, lowercase, numbers, and symbols, your pool size (R) is roughly 94 (26 + 26 + 10 + 32 = 94).
The Entropy Formula
The mathematical formula to calculate the total number of possible combinations is R^L (Pool Size to the power of Length). To convert this massive number into a manageable "bits" score, we take the base-2 logarithm.
The simplified formula for password entropy is: E = L * log2(R)
Let's Run Some Examples
Example 1: The 8-Character Basic Password
Imagine an 8-character password using only lowercase letters (e.g., cjqnwktp).
- Length (L): 8
- Pool Size (R): 26
- Entropy: 8 * log2(26) ≈ 37.6 bits
At ~37 bits, an attacker has to make about 2^37 guesses (137 billion). A modern graphics card can chew through this in minutes.
Example 2: The 8-Character Complex Password
Now let's maximize the pool size but keep it 8 characters long (e.g., X#9vQ!p2).
- Length (L): 8
- Pool Size (R): 94
- Entropy: 8 * log2(94) ≈ 52.4 bits
At ~52 bits, we are looking at 2^52 guesses (4.5 quadrillion). Much better! This might take a standard cracking rig a few days or weeks.
Example 3: The 16-Character Simple Password
What if we double the length, but drop back to only lowercase letters? (e.g., cjqnwktpzbmhxldr)
- Length (L): 16
- Pool Size (R): 26
- Entropy: 16 * log2(26) ≈ 75.2 bits
At ~75 bits, the math explodes. 2^75 is roughly 37 sextillion guesses. This is exponentially harder to crack than the 8-character complex password. It would take millions of years.
The Flaw: Human Predictability
The math above assumes true randomness. It assumes the computer selected characters completely arbitrarily. But humans don't do that.
If your password is password, the math formula says an 8-character lowercase string has 37 bits of entropy. But an attacker won't brute force 137 billion combinations. They will use a dictionary file containing the 10,000 most common passwords. "password" is usually number one.
Because the password is entirely predictable, its actual entropy is essentially zero. This is why our Password Strength Checker tool doesn't just calculate raw entropy. It actively subtracts points if it detects dictionary words, repeated characters (aaaaa), or keyboard walks (qwerty), as these human patterns destroy mathematical unpredictability.
Target Entropy Scores
If you are generating truly random passwords (e.g., via a password manager), what entropy score should you aim for?
- < 40 bits: Unsafe. Can be cracked very quickly.
- 40 - 60 bits: Moderate. Might withstand basic attacks, but vulnerable to dedicated hardware.
- 60 - 80 bits: Strong. Safe for almost all standard online accounts.
- 80 - 100+ bits: Extremely Strong. Highly recommended for Master Passwords or highly sensitive data encryption.
To reach 80+ bits, you simply need length. A 16-character password combining letters, numbers, and symbols comfortably reaches 100+ bits of entropy, rendering brute-force attacks mathematically impossible in our lifetimes.