How Strong Is Your Password? Entropy Explained

Entropy measures unpredictability. Each extra bit doubles the number of possibilities an attacker must try, so a password with 40 bits of entropy needs about a trillion guesses to exhaust, while 60 bits needs a million times more. The formula for a randomly generated password is simple: entropy in bits equals the length multiplied by the log base 2 of the number of possible characters. A 12-character password drawn from the 95 printable ASCII characters carries about 12 × 6.6 ≈ 79 bits — comfortably strong.

The crucial word is randomly. The formula only holds if every character is chosen independently and unpredictably. "Password1!" technically uses four character types but is one of the first things any cracker tries, so its real entropy is close to zero.

Because entropy scales linearly with length but only logarithmically with the size of the character set, adding characters helps far more than adding exotic symbols. Doubling the alphabet from lowercase (26) to mixed-case letters and digits (62) adds under one bit per character, whereas each additional character adds a full share of entropy. That is why a long passphrase of several random words can be both stronger and easier to type than a short string of hieroglyphics.

As a rule of thumb, aim for at least 70–80 bits for important accounts, and more for anything protecting money or infrastructure. But entropy only counts if the password is unique and truly random — reusing even a strong password across sites defeats the purpose, because one breach exposes them all. Generate a fresh random password per account and store them in a password manager. RandomNest's generator shows a live entropy estimate as you adjust length and character sets, so you can watch the strength grow.

A figure like "three million years to crack" only means something with its assumptions attached. It depends on how the site stored the password, how many guesses per second the attacker can make, and whether they are guessing online against a login form or offline against a stolen hash.

The spread is enormous. A single modern GPU can try tens of billions of unsalted MD5 or SHA-1 hashes per second; the same card manages only tens of thousands of guesses per second against bcrypt at cost factor 12, and fewer still against Argon2id tuned to use a gigabyte of memory. The identical password can be worthless or unbreakable depending entirely on a choice the website made.

Online attacks are slower still: rate limiting, lockouts and network latency usually cap an attacker at a few guesses per second per account. That is why credential stuffing, which replays passwords already leaked elsewhere, is far more common than brute force — it needs one attempt per account, and reuse is the only thing that makes it work.

A passphrase draws its entropy from the size of the word list, not from the length of the words. The EFF's long list has 7,776 entries, so each word chosen uniformly contributes log2(7776), about 12.9 bits. Four words give roughly 51.6 bits, five about 64.6 and six about 77.5 — and six random words are far easier to type on a television remote than a sixteen-character jumble.

The arithmetic only holds if the words are picked by dice or by a generator. A phrase you invented yourself is a sentence, and sentences follow grammar and habit — exactly the structure cracking tools model. Capitalising a word or adding a full stop buys you a bit or two; adding a seventh random word buys you thirteen.

NIST's SP 800-63B, the reference most security teams follow, dropped composition rules and scheduled rotation years ago. Forcing an uppercase letter and a digit pushes people towards predictable patterns, and forcing a change every ninety days reliably produces Spring2026! followed by Summer2026!. The current advice is a long minimum, a generous maximum, no arbitrary character classes, and a change only when there is evidence of compromise.

What replaced them is screening. Sites are expected to check new passwords against lists of previously breached ones, which is what Have I Been Pwned's range API does without ever seeing the password: the client sends the first five characters of the SHA-1 hash and filters the returned candidates locally. A password with a hundred bits of entropy that has already appeared in a breach is worth nothing at all.