What Is Password Entropy, and Why Does It Matter?

"Entropy" sounds like physics, and technically it is — the term is borrowed from information theory. In the context of passwords, it's a single number, measured in bits, that describes how unpredictable a password is. It's the most honest way to talk about password strength, because unlike arbitrary rules ("must contain a symbol"), it directly measures how many guesses an attacker needs.

The formula

Entropy in bits is calculated as:

H = L × log2(N)

where L is the length of the password and N is the size of the character set it's drawn from. Each additional bit of entropy doubles the number of possible passwords, and therefore doubles the average number of guesses needed to find it by brute force.

Worked examples

• A 4-digit PIN (digits only, N=10): 4 × log2(10) ≈ 13.3 bits — only 10,000 possibilities
• An 8-character password, lowercase only (N=26): 8 × log2(26) ≈ 37.6 bits
• A 12-character password, full 94-character set: 12 × log2(94) ≈ 78.7 bits
• A 20-character random password, full 94-character set: 20 × log2(94) ≈ 131 bits

Each row up that list represents an astronomically larger search space than the one before it. That's the entire reason length dominates password strength — the relationship is exponential, not linear.

Why entropy isn't the whole story

Entropy assumes the attacker is guessing uniformly at random across the full possible space. Real attackers don't do that — they try common passwords and known patterns first, which is why Password123! is crackable in seconds despite having character variety that looks strong on paper. A password's theoretical entropy only matches its real-world resistance to cracking if it was actually generated at random, not chosen by a human trying to be clever.

What this means practically

You don't need to calculate entropy by hand. You need two things: length (12+ characters for everyday accounts, 16+ for anything sensitive) and genuine randomness, which means letting a generator choose rather than inventing something yourself. Do both and the entropy takes care of itself.