Password entropy, explained.

One bit is one coin flip

Entropy measures how many equally likely possibilities a password was chosen from. One bit means two possibilities, like a coin. Two bits means four. Every extra bit doubles the number of candidates an attacker would have to try, so a password with 40 bits of entropy has about a trillion equally likely alternatives, and one with 41 bits has two trillion.

The word comes from information theory, and the important thing about it is that it describes the process that made the password, not the password itself. The string correcthorsebatterystaple has a lot of entropy if the four words were drawn at random from a big list, and almost none if you copied it from the comic where it appeared.

How the meter gets its number

For a random password the calculation is short. Count the characters in the pool the generator draws from, take the logarithm base two of that count to get bits per character, and multiply by the length.

A 20-character password from the full pool of 85 comes to about 128 bits. Twelve characters from the same pool is 77 bits. Eight lowercase letters is 38 bits, which is why the meter calls it weak no matter how odd the letters look. The Password Generator shows this figure live as you change the settings, and it updates before you press generate, because the number depends only on the settings.

Why a human-chosen password scores lower than it looks

The formula above assumes every character was equally likely. People do not pick characters that way. They start with a capital, end with a digit or an exclamation mark, prefer words to random letters, and swap letters for the symbols that look like them. Cracking software knows every one of those habits and tries them first, so a human-chosen password of twelve characters often has the effective entropy of a random one half its length.

This is also why a meter cannot honestly score a password you typed yourself. It can only see the result, not the process, and the process is what matters. The meter here refuses to guess: it scores the generator's own output, where the process is known.

How many bits are enough?

It depends on where the password is used and how fast an attacker can guess. Online, against a login form that slows down or locks after a few attempts, even 30 bits is a lot, because the site limits the rate. Offline, against a stolen database, the attacker sets the pace, and the pace is set by the hash the site used to store the password.

Against a fast hash like MD5 or SHA-1, modern graphics cards manage on the order of a hundred billion guesses per second. At that rate 40 bits falls in seconds, 60 bits takes months, and 80 bits takes longer than the attacker will live. Against a slow hash such as bcrypt, scrypt or Argon2, every one of those figures stretches by a factor of thousands to millions, because each guess is deliberately expensive.

You do not usually know which hash a site uses, so plan for the fast one. A practical scale looks like this.

Length is the cheap lever

Adding a character type to the pool helps less than people expect. Going from letters and digits to the full pool with symbols adds under half a bit per character. Adding one more character to the password adds a whole six bits. So if a site accepts long passwords and you use a manager to fill them in, length is where the entropy is, and symbols are a small bonus rather than the main event.

Where entropy does not help

No amount of entropy protects a password that was reused on a site that leaked it, typed into a fake login page, or read over your shoulder. Entropy answers exactly one question: how hard is this to guess. The rest of password safety is about uniqueness, two-factor authentication and not trusting the wrong page, and those are habits rather than numbers.

See it in practice with the Password Generator, or read about where the random numbers behind it come from in Where the randomness comes from.