Password Entropy Explained: How Strength Is Really Measured

Published November 8, 2026 · 6 min read · By KeyGuard Pro

Every password checker shows some kind of strength score, and most of them are loosely based on one idea: entropy. This guide explains what entropy is, how to calculate it for a password you generated, and why the number can be misleading for passwords people invent themselves.

What entropy measures

Entropy is a measure of unpredictability, counted in bits. A password with n bits of entropy could have been any of 2ⁿ equally likely possibilities, so an attacker who knows how the password was made would need, on average, about half that many guesses to find it. One extra bit doubles the work; ten extra bits multiply it by roughly a thousand.

The important phrase is "equally likely". Entropy describes the process that produced the password, not the characters you can see. A password drawn at random from a huge set has high entropy. The same characters chosen because they feel memorable do not.

The formula for random passwords

When every character is chosen independently and at random, entropy is simple:

entropy (bits) = length × log₂(size of the character set)

The character sets most generators use look like this:

Digits only: 10 symbols, about 3.32 bits per character.
Lowercase letters: 26 symbols, about 4.70 bits per character.
Upper and lowercase letters plus digits: 62 symbols, about 5.95 bits per character.
All keyboard symbols (about 94 printable characters): about 6.55 bits per character.

So a random 12-character password of lowercase letters has about 56 bits. Make it 12 characters from the full 94-symbol set and it jumps to about 79 bits. Make it 16 characters from the full set and you reach roughly 105 bits.

Length versus variety

Notice how much each lever contributes. Going from lowercase letters (4.70 bits per character) to the full symbol set (6.55 bits) adds about 1.85 bits per character. Adding one more character to a password of any type adds 4.7 to 6.5 bits all by itself. For a 12-character password, adding symbols and capitals is worth about 22 bits in total. Adding four more characters would be worth between 19 and 26 bits, with no change to the rules.

That is why current guidance from standards bodies such as NIST emphasizes length and checking against lists of known-bad passwords instead of strict composition rules like "one capital, one number, one symbol". Those rules push people toward predictable patterns, such as a capital at the start and a digit and exclamation mark at the end.

Why human-made passwords are weaker than they look

A tool that scores "Summer2026!" as 11 characters of mixed types will give it a respectable-looking number if it only counts characters. In reality an attacker's software does not try every combination. It tries dictionary words first, then applies the habits people share: capitalize the first letter, add a year, add a symbol at the end, swap "a" for "@". "Summer2026!" sits near the front of that search.

The true entropy of a human-chosen password is the number of guesses a smart attacker would need, and that is usually far lower than the length-and-character-set formula suggests. A useful rule of thumb: the entropy formula is only valid for passwords that came from a random generator. For anything else, treat the number as a ceiling, not a measurement.

How much entropy is enough?

It depends on how the password is protected on the other side, which you usually cannot see.

Online guessing (typing guesses into a login page) is slow and limited by lockouts and rate limits, so even 40 to 50 bits is out of reach for a casual attacker.
Offline cracking happens after a site's password database is stolen. If the site used slow, modern password hashing, guesses are expensive. If it used a fast hash, an attacker with graphics cards can test billions of guesses per second.

Because you cannot know which kind of site you are dealing with, the safe choice is to assume the worse case. For important accounts, aim for 80 bits or more from a generator, and for a password manager's master password, aim higher still, since it protects everything else.

A quick worked example

Suppose a generator produces a 14-character password using all 94 symbols. Each character carries log₂(94), about 6.55 bits, so the password has 14 × 6.55 = 91.8 bits. The number of possibilities is 2^91.8, about 4 × 10²⁷. Even at ten billion guesses per second, searching half of that space would take roughly seven billion years. That is why length from a generator beats cleverness every time.

Practical takeaways

Let a generator pick your passwords; entropy only means something for random choices.
Prefer length. Each added character is worth more than any single rule.
Never reuse a password, because a strong password that leaks from one site is useless on the next.
Use a password manager so that length is not a burden.

You can try the numbers yourself in the KeyGuard Pro generator: raise the length and watch the entropy estimate climb.