Entropy and Password Strength
Bits of entropy, in plain terms, and why a longer random password beats a cleverer one.
Password strength is measurable, and the measurement is simpler than the advice usually suggests. It is the number of possibilities an attacker would have to try, expressed as a base-2 logarithm and called bits of entropy.
The useful consequence is that length beats complexity by an enormous and calculable margin. Adding one character to a random password from a 62-character alphabet multiplies the search space by 62; adding symbols to a 12-character password multiplies it by about 2.5.
This page covers how to compute the number, what it does and does not mean, and why the standard advice about character classes is mostly wrong.
Computing entropy for a random password
If every character is chosen independently and uniformly from an alphabet of size A, and the password is L characters long, then there are A to the power L possible passwords. The entropy in bits is L multiplied by the base-2 logarithm of A.
A lowercase-only alphabet is 26 characters, which is about 4.7 bits per character. Adding uppercase makes 52, about 5.7 bits. Adding digits makes 62, about 5.95 bits. Adding common symbols makes roughly 95, about 6.55 bits.
So a 12-character password from the 62-character alphabet carries about 71 bits. The same length from the 95-character alphabet carries about 79 bits — an increase of 8 bits, which is a factor of 256. Two extra characters at 62 would have given 12 bits, a factor of 4,096.
Length against alphabet, in bits
- 12 characters, lowercase only (26): about 56 bits.
- 12 characters, mixed alphanumeric (62): about 71 bits.
- 12 characters, with symbols (95): about 79 bits.
- 16 characters, mixed alphanumeric (62): about 95 bits — more than symbols ever bought you.
The word that does all the work: random
The entropy calculation assumes every character was chosen independently and uniformly. That assumption is false for every password a human invented, and the gap is not small.
A password built by capitalising a word, appending a year and substituting a digit for a letter has an enormous nominal entropy and a tiny real one, because an attacker does not search the whole space — they search the space of passwords humans actually produce, which is many orders of magnitude smaller.
This is why the entropy figure only means something for a generated password. For a chosen one it is a ceiling that bears no relationship to the real difficulty, and quoting it is worse than useless because it is reassuring.
Why passphrases work
A passphrase of randomly chosen words is the same calculation with a different alphabet. Choosing uniformly from a 7,776-word list gives about 12.9 bits per word, so a six-word passphrase carries about 77 bits — comparable to a 13-character random password and considerably easier to type and remember.
The critical requirement is the same word: the words must be chosen randomly from the list, not by you. A phrase you thought of has the same problem as a password you thought of, and the fact that it is long does not help.
The practical trade is that a passphrase is longer to type and easier to remember, and a random character string is shorter and needs a password manager. Both are fine; neither is fine if a human chose the content.
- 7,776-word list: about 12.9 bits per word.
- 4 words: about 51 bits. 5 words: about 64. 6 words: about 77.
- The words must be drawn randomly, not chosen — this is the whole thing.
- A memorable phrase you invented has a fraction of the entropy it appears to.
What the bits actually mean
Entropy measures the size of the search space, not the time to crack. Translating one to the other requires knowing how fast an attacker can guess, which depends entirely on how the password is stored.
Against a well-designed password hash, an attacker might manage tens of thousands of guesses per second per machine. Against an unsalted fast hash, billions. That is a difference of five orders of magnitude, which is roughly 17 bits — so the storage scheme is worth more than any realistic choice about character classes.
The honest summary is that entropy tells you how much your password contributes, and the storage tells you what that contribution is worth. You control the first and cannot see the second, which argues for more bits rather than fewer.
Where the standard advice goes wrong
Requiring one uppercase, one digit and one symbol reduces entropy rather than increasing it. It shrinks the space of valid passwords by excluding the ones that lack those characters, and it pushes humans toward a predictable pattern — capital at the start, digit and symbol at the end — which attackers exploit directly.
Mandatory rotation has the same shape of problem. Forcing a change every ninety days produces passwords derived from the previous one by incrementing a number, which is exactly the transformation a cracking rule can encode.
Modern guidance from the major standards bodies has moved away from both, toward length minimums, blocklists of known-breached passwords, and no forced rotation without evidence of compromise. That advice is easier to follow and better supported.
Frequently asked questions
How do I compute entropy?
Length multiplied by log₂ of the alphabet size. Twelve characters from a 62-character alphabet is 12 × 5.95, about 71 bits.
Is length or complexity better?
Length, by a wide margin. Two extra characters at 62 options multiply the space by 3,844; adding symbols to a 12-character password multiplies it by about 256.
Does this apply to passwords I made up myself?
No. The calculation assumes uniform random selection. A human-chosen password has a fraction of its nominal entropy and quoting the figure is actively misleading.
How many bits is enough?
It depends on the storage, which you cannot see. Against a well-designed hash, 70 bits is comfortable; against a fast unsalted one, considerably more is needed.
Are passphrases as good as random strings?
Yes, if the words are drawn randomly. Six words from a 7,776-word list is about 77 bits, comparable to a 13-character random password.
Why is 'must contain a symbol' bad advice?
It shrinks the valid space and pushes people toward predictable placement — capital first, digit and symbol last — which cracking rules encode directly.
Should I change my passwords regularly?
Current standards guidance says no, absent evidence of compromise. Forced rotation produces incremented variants of the previous password.
Does entropy tell me how long a password takes to crack?
No — only how large the search space is. The time depends on the attacker's guess rate, which is determined by how the password is stored.
Tools that use this
Related guides
Web Crypto getRandomValues: A Reference
What the browser API guarantees, what it does not, and the limits worth knowing.
Pseudo-Random vs Cryptographic Randomness
Two generators, two guarantees, and the surprisingly small list of cases where the difference bites.
The Birthday Problem and Collisions
Why 23 people is enough for a shared birthday, and where else the same maths ambushes you.