Password Entropy, Explained With Real Numbers
Published 2026-07-20
Password strength meters are vibes. Entropy is arithmetic. Here is the actual math behind "password strength," crack times computed from real hardware numbers, and an honest look at which of the rules you have been forced to follow do anything at all.
What a bit of entropy is
Entropy measures how many equally likely possibilities a password was drawn from, expressed as a base-2 logarithm. A password picked uniformly from 1,024 possibilities has 10 bits of entropy, because 210 = 1,024. Every added bit doubles the number of guesses an attacker needs in the worst case. For a randomly generated password the formula is simple: entropy = length × log2(alphabet size).
The word "randomly" is doing all the work in that sentence. The formula applies only when every character is chosen by a proper random generator. A password a human invented does not qualify: humans draw from a tiny, heavily skewed pool of names, dates, keyboard walks, and words with a 1 tacked on, and cracking software is built around exactly those patterns.
The per-character numbers
Lowercase letters only: 26 symbols, 4.70 bits per character. Add uppercase: 52 symbols, 5.70 bits. Add digits: 62 symbols, 5.95 bits. Add every printable ASCII symbol: 95 symbols, 6.57 bits. Notice how weak that progression is. Going from lowercase-only all the way to the full 95-symbol soup gains less than 2 bits per character, while adding one more character to the password gains 4.7 to 6.6 bits. Length beats character-set complexity every time, and it is not close.
Crack times, concretely
Assume the worst realistic case: your password hash leaked in a breach, the site used a fast algorithm like MD5 or NTLM (the same kind of hash you can compute instantly in our hash generator, which is precisely the problem), and the attacker runs a modern multi-GPU rig doing about 100 billion guesses per second. Time to try every combination:
| Password | Entropy | Time to exhaust |
|---|---|---|
| 8 random lowercase letters | 37.6 bits | about 2 seconds |
| 8 random characters, full 95-symbol set | 52.6 bits | about 18 hours |
| 12 random lowercase letters | 56.4 bits | about 11 days |
| 5 random diceware words | 64.6 bits | about 9 years |
| 16 random lowercase letters | 75.2 bits | about 14,000 years |
| 6 random diceware words | 77.5 bits | about 70,000 years |
| 12 random characters, full 95-symbol set | 78.8 bits | about 170,000 years |
Halve those numbers for the average case, since an attacker typically finds the password halfway through the space. If the site used a slow hash like bcrypt or Argon2, the guess rate collapses by a factor of a million or so and every row gets a million times longer. But you rarely know what a site uses, so plan for the fast case.
Why passphrases win
A word chosen at random from the standard 7,776-word diceware list is worth log2(7776) = 12.9 bits. Five words reach 64.6 bits; six words reach 77.5 bits, roughly the strength of 12 truly random characters drawn from the full symbol set. The difference is that "maple-thunder-oboe-crisp-vandal" can be typed on a phone keyboard and remembered after a few uses, and "xX9#qL!2mFp$" cannot. The same caveat applies, though: the words must come from a random generator. Pick them yourself and you will pick common, related words, and the real entropy craters.
Where good randomness comes from
Every modern browser exposes a cryptographically secure random generator, crypto.getRandomValues, which is seeded from the operating system's entropy pool. A generator built on it, with care taken to avoid biased sampling when mapping random bytes onto a character set, produces passwords whose entropy actually matches the formula. That is the whole difference between a generated password and an invented one: the generated password's entropy is real and computable, while the invented one's is a guess, and usually a flattering one.
Three myths worth retiring
Mandatory symbols. Composition rules ("at least one uppercase, one digit, one symbol") barely move the math, as the per-character numbers above show, and in practice they push people toward predictable templates: capital first letter, exclamation mark last, @ for a. Cracking rulesets have encoded those substitutions for decades, so P@ssw0rd! falls in milliseconds no matter what a strength meter says. NIST's guidance (SP 800-63B) has recommended against composition rules since 2017.
Forced rotation every 90 days. The predictable outcome is Summer2025! becoming Autumn2025!. NIST again: change a password when there is evidence of compromise, not on a calendar.
Judging entropy by looking at the string. Entropy is a property of the process that generated a password, not of the output. "xK4pQ9vT" invented in your head is far weaker than eight characters from a cryptographic random generator, even though the two look identical. This is also why strength meters mislead: they can only see the output.
Practical targets
For accounts where an attacker can only guess online against a rate limiter, 40 bits is plenty: at 100 guesses per hour, walking through even 230 possibilities would take over a thousand years. For anything that could be attacked offline after a breach, which is the safe assumption for accounts you care about, aim for 75 bits or more: about 14 random mixed characters, or six diceware words. And make each password unique per site so one breached forum cannot unlock your email, which realistically means a password manager plus a generator.
If you want to see the math in action, norito's password generator offers both modes, random character strings and word-based passphrases, with a live entropy readout. Like every tool on this site, it runs entirely in your browser, which is rather the point for passwords.