Making strong secrets · 4 min read
Password entropy, explained in bits
Entropy counts how many equally likely secrets a method could have produced, in powers of two. It is exact for random generators and only a rough guess for anything a person picked.
“Bits of entropy” is the usual way to state how hard a secret is to guess. The phrase sounds technical, but the idea underneath is counting, and once you see it the numbers on this site’s tools become easy to read.
The definition
NIST’s glossary in SP 800-63B-4 defines entropy as “the amount of uncertainty that an attacker faces to determine the value of a secret,” and adds: “A value with n bits of entropy has the same degree of uncertainty as a uniformly distributed n-bit random value.”
In plain terms: if a method picks uniformly from N equally likely possibilities, its entropy is log2(N) bits. One bit is one fair coin flip, two possibilities. Ten bits is 2^10 = 1,024 possibilities. Every added bit doubles the count; EFF’s deep dive puts it as “Adding one bit of entropy doubles the number of guesses required.”
Calculating it
For a secret built from independent random choices, you add the bits of each choice, because the counts multiply and logarithms turn multiplication into addition.
| One random choice from | Possibilities | Bits per choice |
|---|---|---|
| A digit | 10 | 3.322 |
| A lowercase letter | 26 | 4.700 |
| A letter or digit | 62 | 5.954 |
| Any printable ASCII character | 94 | 6.555 |
| A word from the EFF large list | 7,776 | 12.925 |
Worked example: eight lowercase letters
A generator picks 8 lowercase letters uniformly and independently.
- Possibilities: 26^8 = 208,827,064,576.
- Bits: 8 × log2(26) = 8 × 4.700 = 37.60 bits.
- Check: 2^37.60 is about 2.09 × 10^11, which matches the count.
An attacker trying every combination needs 208.8 billion guesses at most and about half that, 104.4 billion, on average. At an assumed 10,000 guesses per second against a slow, salted hash, that average is 104.4 billion ÷ 10,000 ÷ 86,400 ≈ 121 days. Against a fast unsalted hash at an assumed 10^11 guesses per second, it is about one second. The same 37.6 bits, very different outcomes: entropy tells you the size of the haystack, and the attack rate tells you how fast someone is searching it.
| Scenario | Rate (assumed) | Situation |
|---|---|---|
| Online, rate-limited | 100 guesses per hour | a login form that slows down or locks out repeated failures |
| Offline, slow hash | 10,000 guesses per second | a stolen database hashed with a deliberately slow, salted scheme (bcrypt class) |
| Offline, fast hash | 100 billion guesses per second | a stolen database hashed with a fast unsalted hash (MD5, SHA-1 or NTLM class) on a high-end GPU rig |
The table below runs the same arithmetic for common formats.
| Secret | Bits | Online, 100/hour | Slow hash, 104/s | Fast hash, 1011/s |
|---|---|---|---|---|
| 4-digit PIN | 13.3 | 2.1 days | less than a second | less than a second |
| 6-digit PIN | 19.9 | 208 days | 50 seconds | less than a second |
| 8 random lowercase letters | 37.6 | 119 thousand years | 121 days | 1 second |
| 8 random printable characters | 52.4 | 3.5 billion years | 9.7 thousand years | 8.5 hours |
| 12 random letters and digits | 71.5 | about 1015 years | 5.1 billion years | 511 years |
| 3 random EFF words | 38.8 | 268 thousand years | 272 days | 2.4 seconds |
| 4 random EFF words | 51.7 | 2.1 billion years | 5.8 thousand years | 5.1 hours |
| 5 random EFF words | 64.6 | 16 trillion years | 45 million years | 4.5 years |
| 6 random EFF words | 77.5 | about 1017 years | 350 billion years | 35 thousand years |
| 7 random EFF words | 90.5 | about 1020 years | about 1015 years | 272 million years |
| 16 random printable characters | 104.9 | about 1025 years | about 1019 years | 5.9 trillion years |
| 20 random printable characters | 131.1 | about 1033 years | about 1027 years | about 1020 years |
Entropy belongs to the method, not the string
This is the point most often missed. Look at the string panoramic. As nine lowercase letters it looks like 9 × 4.700 = 42.30 bits. But if it was produced by picking one word from the EFF list, it is worth exactly 12.925 bits, because the attacker only has to search 7,776 words, not 26^9 letter combinations.
The reverse also holds. xkqvwmzpt and panoramic are both nine lowercase letters. If both came from a uniform letter generator, both are worth 42.30 bits. You cannot tell how strong a secret is by looking at it; you need to know the process that made it.
That is why this site’s generators report entropy computed from the settings: the size of the set they pick from and how many picks they make. They never estimate it from the output.
Average versus worst case
An attacker guessing in some order finds a uniformly random secret after half the possibilities on average. So the expected work for b bits is 2^(b−1) guesses, one bit less than the full space. The tables on this site use that average. The attacker could get lucky early or unlucky late; with a uniform choice, every position in the search order is equally likely.
Why “entropy” for human-chosen passwords is shaky
The formulas above need a uniform choice. People don’t choose uniformly. A person asked for an eight-letter password doesn’t pick from 26^8 options with equal probability; they pick words, names, and patterns, and attackers try those first.
NIST says this directly in Appendix A: “While entropy can be readily calculated for data with deterministic distribution functions, estimating entropy for user-chosen passwords is challenging.” For that reason the 2025 guidance bases its password rules mainly on length and blocklists, not on entropy scores.
Strength checkers, including the one on this site, deal with this by looking for the cheapest explanation of a typed password: a common-list match, dictionary words, keyboard walks, dates, repeats. They charge bits for each piece and add them up. The result is an estimate of how an attacker would model the string, not a measurement. The strength checker shows each line of that estimate so you can see what it assumed, and how strength meters work explains the approach.
Reading the numbers
Some rough landmarks, using the site’s assumed rates and average times:
- Under about 20 bits (a 6-digit PIN is 19.93): fine only where guesses are tightly limited, such as a device that locks after a few wrong tries.
- Around 40 bits (3 EFF words is 38.77): resists online guessing but not an offline attack against a fast hash.
- Around 65 bits (5 EFF words is 64.62): averages about 4.5 years against a fast hash at 10^11 guesses per second.
- Around 77 bits and up (6 EFF words is 77.55; 16 random printable characters is 104.87): beyond any offline attack this site models.
These bands depend on the attack-rate assumptions above, which are illustrations, not measurements. The crack-time calculator lets you change them.
Note: High entropy guards against guessing only. A 100-bit password typed into a phishing page, or reused on a site that stores it badly, is exposed just the same.
For the effect of length versus character variety on these numbers, see length beats complexity.
Sources
General explanation, not advice for a particular situation. Updated 2026-10-31.