Password Entropy, Explained in Bits

Entropy is the one honest number in password strength: it counts, in bits, how many yes/no questions an attacker must answer to find your password by guessing. A password with B bits of entropy takes on average 2^B−1 guesses. For a password drawn uniformly at random, the math is a single line — bits = length × log₂(pool size) — and every figure on this site comes from it.

bits = length × log₂(pool size)

One bit, one doubling

Each bit doubles the search space. A pool of 94 printable characters gives log₂(94) ≈ 6.55 bits per character, so a 16-character password carries 104.9 bits and an attacker faces 2¹⁰⁵ possibilities. Nothing about that depends on the password "looking random" — it depends only on it actually having been drawn uniformly from the pool. That is why this site generates with crypto.getRandomValues and rejection sampling rather than asking you to mash keys: mashed keys are not a uniform draw.

Pool sizes, honestly

Pool	Size	Bits per character	12 characters	16 characters
Digits	10	3.32	39.9 bits	53.2 bits
Lowercase	26	4.70	56.4 bits	75.2 bits
Lowercase + digits	36	5.17	62.0 bits	82.7 bits
Letters	52	5.70	68.4 bits	91.2 bits
Letters + digits	62	5.95	71.5 bits	95.3 bits
All printable ASCII	94	6.55	78.7 bits	104.9 bits

The same formula prices words. Drawing uniformly from a list of 1,316 words gives log₂(1316) ≈ 10.36 bits per word — more per unit than any single character, which is why five words reach 51.8 bits while staying typeable. Entropy does not care whether the symbols are letters or words; it cares how many there are and how they were chosen.

Where the headline number leaks

The formula prices a uniform random draw. Human choices are not uniform, so their true entropy is lower — often far lower — than the formula suggests:

Words: "sunshine" is 8 characters but appears in every breach dictionary; its effective entropy is closer to its rank in that list than to 8 × 4.7 bits.
Patterns: capital first letter, digit and symbol at the end, a year in the middle — cracking rules encode these shapes and try them early.
Substitutions: @ for a and 0 for o are in the same rule sets. They add keystrokes, not bits.

The strength checker turns that into arithmetic: it starts from the formula and subtracts explicit penalties for each pattern it finds, so you can see the deduction rather than trust a color. And the clean way to keep the full headline number is to not choose at all — generate the password, or draw the words, and let uniformity do the work.

FAQ

How many bits is "enough"?

Against offline guessing at a stated 10 billion guesses/second, 60 bits lasts months-to-years and 80 bits lasts geological time. This site recommends ≈95+ bits for stored passwords (16 characters, letters+digits+symbols) simply because managers make it free.

Is entropy the same as password strength?

Entropy is the measurable part of strength: resistance to guessing. It says nothing about phishing, reuse, or malware, which defeat strong passwords without guessing. Both halves matter.

Why do calculators disagree about the same password?

They assume different pools and different pattern penalties. Any calculator that will not show its formula and deductions is asking for trust instead of offering evidence; this one shows both.