What password entropy is
It is a way of counting how many different passwords the same method could have produced. If a password has n bits, there were 2n equally likely possibilities. Each extra bit doubles the attacker’s work: 80 bits is not “a little more” than 70, it is 1,024 times more.
The term comes from Claude Shannon’s information theory, and for passwords it is used in a very specific sense: it measures the method used to create the password, not the password itself.
If a password has L symbols and each is chosen at random, with equal probability, from N possible ones:
bits = L × log₂(N)
A symbol can be a character or a whole word. These are the most common values of N:
| Symbol set | N | Bits per symbol |
|---|
| Digits (0–9) | 10 | 3.32 |
| Lowercase | 26 | 4.70 |
| Upper and lowercase | 52 | 5.70 |
| Letters and digits | 62 | 5.95 |
| Letters, digits and 32 symbols | 94 | 6.55 |
| Words from a Diceware list | 7,776 | 12.92 |
Our generator makes one more adjustment: if you tick several character types, it requires at least one of each, which rules out some combinations. We subtract those using the inclusion–exclusion principle, so the figure you see is exact.
Examples
- Random 4-digit PIN: 4 × 3.32 = 13.3 bits. About 10,000 possibilities.
- 8 characters of all four types: about 51 bits. It sounds like a lot, but at 10 billion guesses per second it is exhausted in a day.
- 16 characters of all four types: 104.6 bits. Out of reach of any foreseeable attack.
- 6-word passphrase: 6 × 12.92 = 77.5 bits.
The generator shows the exact bits of what it creates, updated whenever you change a setting.
Password generatorWhen the figure misleads
The formula only holds if every symbol was truly chosen at random. Applied to a password a person made up, it produces meaningless numbers:
Chelsea1985! has 12 characters of all four types. The formula would say 12 × 6.55 ≈ 79 bits, “strong”. But an attacker does not try random combinations: they try capitalized words followed by a year and a symbol. That route has a few hundred million candidates, under 30 bits, and they are exhausted in less than a second.
That is why our checker does not just apply the formula: it looks for words, names, dates and keyboard walks, and estimates how many guesses it would take following those patterns. For a password that already exists, it is a far more realistic estimate.
The same goes for badly calculated passphrases. Many sites treat velvet-canyon-lantern-pebble as 28 random characters and give it more than 150 bits. But it is 4 words from a known list: 51.7 bits.
How many bits you need
| Bits | Level on our meter | Good for |
|---|
| under 40 | Very weak | Only behind an attempt limit (a PIN) |
| 40 to 69 | Weak | Accounts with two-factor authentication on a service that stores passwords properly |
| 70 to 99 | Strong | Any account |
| 100 or more | Very strong | Master passwords, encryption, keys that must last decades |
What that means in time, for several attack scenarios, is in the table of how long it takes to crack a password.