Password Entropy Explained: What the Bits Actually Measure

Key takeaways

• Password entropy describes uncertainty in a generation process rather than a visible property of a string.
• The familiar length-times-logarithm formula assumes independent uniform choices.
• Human patterns and predictable substitutions invalidate simple character-set estimates.
• Guessing resistance, unique passwords, secure storage, and phishing protection address different risks.

Password entropy describes uncertainty in how a password is generated. When a process chooses uniformly from a known set of possibilities, that uncertainty can be expressed in bits.

The distinction is important. A password containing capitals, digits, and punctuation does not automatically have the entropy of a random generator using those characters.

Imagine two employees choosing a password for a new account. One invents Autumn2026!; the other uses a password manager to generate a random string. A meter that only counts character types can give a misleading comparison because the two selection processes are very different.

The Formula Requires Equally Likely Choices

If a generator chooses uniformly from N possible passwords, the entropy is:

H = log2(N)

For L characters chosen independently and uniformly from an alphabet of S characters:

N = S^L
H = L × log2(S)

The assumptions do the important work. Every choice must have the stated probability, and one choice must not constrain the next.

Generation process	Approximate entropy
Uniform four-digit PIN, including leading zeros	13.3 bits
Eight independent lowercase letters	37.6 bits
Sixteen independent characters from 94 symbols	104.9 bits

These figures are calculated from the specified processes. They are not strength ratings for arbitrary strings of the same length.

Human Choices Have Patterns

The employee who chooses a season, year, and exclamation mark is drawing from a much narrower pattern than all possible ten-character strings.

An attacker can prioritize common words, dates, substitutions, and leaked passwords. Replacing an “a” with an “@” does not force the attacker to begin searching an entirely unfamiliar space.

Pattern-aware estimators such as zxcvbn attempt to account for common constructions. Their results are still estimates based on a guessing model, not measurements of a person’s hidden selection process.

A precise-looking bit count can therefore communicate more confidence than the evidence supports.

Random Passphrases Can Be Calculated Too

If each word is selected independently and uniformly from a 7,776-word list, each selection contributes about 12.9 bits.

Four random words: 4 × log2(7776) ≈ 51.7 bits
Six random words:  6 × log2(7776) ≈ 77.5 bits

The EFF dice-based passphrase method provides a concrete way to make random selections from a published list.

A quotation or personally invented sentence does not inherit those numbers. Neither does choosing random words and repeatedly replacing the awkward ones without accounting for how that changes the distribution.

Fixed separators can improve readability, but they do not add uncertainty when the attacker knows the format.

Bits Do Not Directly Predict Cracking Time

For N equally likely candidates, an exhaustive search without repeated guesses needs roughly N/2 attempts on average.

Converting that into time requires a guessing rate. A rate measured against a fast hash cannot be applied to a deliberately expensive password verifier.

An online attacker must interact with the service and may face throttling, monitoring, and additional authentication. An offline attacker with stolen verifier data can test guesses on their own hardware.

That makes the password hashing or key-derivation function, its settings, and the attacker’s resources central to offline cost.

Entropy concerns uncertainty; the verifier controls part of the price paid for each guess.

A Longer Derived Key Does Not Add Password Entropy

Suppose a file-encryption tool derives a 256-bit key from the employee’s predictable password.

The attacker can guess passwords and reproduce that derivation rather than try every possible 256-bit key. The output length does not create uncertainty that was absent from the input.

This is why choosing AES-256 instead of AES-128 cannot compensate for a weak passphrase by itself.

A suitable password KDF makes guesses more expensive, while stronger password generation makes successful guesses less likely.

Reuse and Phishing Bypass the Guessing Problem

Even a randomly generated password can expose several accounts if reused and stolen from one service.

Generating a different password for each account limits that reuse risk. A password manager makes this practical without requiring someone to memorize every generated value.

Phishing can obtain a strong password directly, and two-factor authentication provides a separate layer with method-specific protections.

None of these properties can be inferred from an entropy score.

Use the Model to Improve the Process

NIST’s password guidance emphasizes controls such as sufficient length, screening against common or compromised choices, rate limiting, and support for password managers. It also explains the difficulty of assigning entropy to user-chosen passwords.

For the two employees, the useful improvement is an account-unique password generated by a trustworthy random process, together with appropriate account protection.

Use entropy calculations when the generator’s distribution is known. For human-created passwords, discuss likely patterns and attack conditions instead of presenting a character-count formula as a guarantee.

A password can look complicated without having been difficult to predict.