Password Entropy: How to Calculate It and What the Bits Mean
Password entropy explained: the formula, worked examples for random passwords and passphrases, what the bits mean in guesses, and where the maths breaks.
By TheTextKit TeamPublished
A card shows the formula bits equals length times log2 of the pool, with the example 16 lowercase letters: 16 times 4.70 bits is 75.2 bits. Three notes say each bit doubles the guesses, the result holds only for random passwords, and it is an upper bound.
Password entropy measures how unpredictable a password is, counted in bits. For a password picked at random, it equals the password's length times the base 2 logarithm of the number of symbols it could use. Sixteen random lowercase letters give 16 times 4.70, which is 75.2 bits. Each extra bit doubles the guesses an attacker needs, so small differences in bits are huge differences in effort. This guide shows how to calculate password entropy, what the bits mean in time, why passphrases work, and where the maths stops matching real passwords.
What password entropy is
Wikipedia's article on password strength writes the formula as H = log2(N^L), which is the same as L times log2(N). Here N is the number of possible symbols and L is the length. The result is in bits, and the same article notes that increasing the entropy by one bit doubles the number of guesses required.
Two words matter in that definition. The formula describes a password chosen at random by a machine, which is what makes every character independent. And it counts the size of the search space, not how clever a password looks.
Five rows show a pool size and the bits each pick adds: 26 lowercase letters add 4.70 bits, 36 letters and digits add 5.17, 62 letters and digits in both cases add 5.95, 95 printable characters add 6.57, and a 7,776 word list adds 12.92 per word.
How to calculate password entropy
You need two numbers: the length, and the size of the symbol pool. Then multiply the length by log base 2 of the pool. The pool depends on what the password can contain:
| Symbol pool | Size | Bits per character |
|---|---|---|
| Lowercase letters | 26 | 4.70 |
| Lowercase letters and digits | 36 | 5.17 |
| Letters of both cases and digits | 62 | 5.95 |
| All printable ASCII, with space | 95 | 6.57 |
| A word from a 7,776-word list | 7,776 | 12.92 |
Wikipedia gives 94 printable ASCII characters and about 6.55 bits each. Our checker counts the space as well, which makes 95 and 6.57 bits. The difference is tiny, but it explains why different tools disagree in the first decimal.
A pool only counts characters the password could really have used. If a password has only lowercase letters, its pool is 26, even if you could have typed capitals.
Password entropy examples
We calculated each of these by hand and then compared them with the Password Strength Checker. The times are the average at 100 billion guesses a second, which is a comparison figure and not a measurement:
| Random password | Bits | Average time to guess |
|---|---|---|
| 10 digits | 33.2 | 50 milliseconds |
| 8 lowercase letters | 37.6 | 1.0 seconds |
| 4 words from a 7,776-word list | 51.7 | 5.1 hours |
| 8 characters from the whole keyboard | 52.6 | 9.2 hours |
| 16 lowercase letters | 75.2 | 6.9 thousand years |
| 6 words from a 7,776-word list | 77.5 | 35 thousand years |
| 12 characters from the whole keyboard | 78.8 | 86 thousand years |
Length beats variety. Sixteen random lowercase letters have 75.2 bits, far more than eight characters from every key on the keyboard at 52.6. That is the arithmetic behind NIST's advice, which we cover below.
A table of seven random passwords with their bits and average guess time, from 10 digits at 33.2 bits and 50 milliseconds to 12 keyboard characters at 78.8 bits and 86 thousand years.
What the bits mean in guesses and time
A password with b bits has 2 to the power of b possible values, and an attacker who tries them in random order finds it, on average, after half of them. That is why every bit doubles the work. At 100 billion guesses a second, 40 bits takes an average of 5.5 seconds, 41 bits takes 11 seconds, and 50 bits takes 1.6 hours.
The guess rate is an assumption. Our checker shows two, 100 billion a second and 1 million a second, because the right one depends on how the passwords are stored and attacked. At 1 million a second, the 6-word passphrase's 77.5 bits stretch to 3.5 billion years.
Three rows at 100 billion guesses a second: 40 bits takes 5.5 seconds on average, 41 bits takes 11 seconds, and 50 bits takes 1.6 hours.
Online attacks are slower still, because a site can lock an account. NIST SP 800-63B-4 says a verifier must limit consecutive failed attempts on an account to no more than 100. With 100 tries, an attacker facing an 8-lowercase-letter password at 37.6 bits has about a 1 in a billion chance of success.
Passphrases and password entropy
Words give you bits per pick instead of bits per character. The EFF's long wordlist has 7,776 words, built for five dice, and each word adds about 12.9 bits. The EFF suggests six words for a strength of 77 bits. That matches our table: 77.5 bits, about 35 thousand years at the 100 billion rate.
The catch is that the words must be picked at random, for example by dice or a generator. A phrase you invent, a quote or a lyric has far less entropy, because people choose from a small set of familiar phrases. Our checker scores text made only of separate words as that many words from the 7,776-word list, which is the best case, and warns that it is.
Where password entropy stops matching reality
The formula assumes every character is independent. People are not random. Wikipedia cites a study of half a million users that estimated the average password entropy at about 40.5 bits. It also says an older NIST estimation scheme was not a valid metric for human-chosen passwords.
Our checker shows the problem. For MyDogRex1987, a pet name plus a birth year, it reports 65.5 bits, which rates as fair. That number is an upper bound that holds only if the characters were random. In practice a name followed by a year is far easier to guess, and our checker flags the year habit. Meanwhile, passwords such as Welcome1 and letmein are on the checker's list of about 150 very common passwords, so it caps them at about 7.3 bits whatever the formula says.
A table of three passwords scored by the checker. MyDogRex1987 scores 65.5 bits as an upper bound that holds only for random characters, while Welcome1 and letmein are on the common-password list and are capped at 7.3 bits.
How many bits of password entropy do you need?
NIST does not set a bit target. It sets minimum lengths: in SP 800-63B-4, a password used as the only factor must be at least 15 characters, and one used only with another factor at least 8. It also says verifiers must not impose other composition rules, such as requiring mixtures of character types. That fits the arithmetic: length adds bits faster than symbols do.
As a practical rule, aim for random passwords near 75 bits or more, and let a password manager generate and store them. Our guide to how long a password should be covers the NIST rules in more detail.
Check your password entropy with the Password Strength Checker
The Password Strength Checker does the calculation as you type, entirely in your browser. You get the bits, the average time at two guess rates, the online chance within 100 attempts, and a check against the NIST length minimums. Repeats, sequences such as abc and keyboard runs such as qwerty are counted as adding little, and separate words are scored as picks from a word list.
The checker is not a breach database, and it says so. It compares against a short list of about 150 common passwords only. Test a password similar to your real one, not the real one itself, and use the Password Generator when you want a random one.
Frequently asked questions
What is password entropy?
It is a measure of how unpredictable a password is, counted in bits. Each bit doubles the number of guesses an attacker needs. For a password chosen at random, entropy equals its length times the base 2 logarithm of the number of possible symbols.
How do you calculate password entropy?
Count the length and the size of the symbol pool, then multiply the length by log base 2 of the pool. Sixteen random lowercase letters give 16 times 4.70, which is about 75.2 bits.
How many bits of entropy is a strong password?
There is no single official number. NIST sets minimum lengths instead: 15 characters when a password is the only factor and 8 when a second factor is used. As a rough guide, random passwords near 75 to 80 bits are very hard to guess by trial.
Is a passphrase better than a complex password?
A random passphrase of six words from a 7,776-word list has about 77.5 bits, about the same as 12 random characters from the whole keyboard, and it is much easier to remember. The words must be picked at random, not chosen by you.
Why does the entropy of a password I chose myself come out too high?
The formula assumes every character was picked at random. People choose names, dates and common patterns, so the true entropy is lower. A study cited by Wikipedia put the average at about 40.5 bits.
Work out the entropy of your next password
Pick the length and the pool of your next password and do the sum: length times log base 2 of the pool. Then check it in the Password Strength Checker. If the number is under 75 and the password is random, add characters or words, because every extra bit doubles the work for anyone guessing.
