Cybersecurity

What Is Password Entropy? Simply Explained

Password entropy is a number, measured in bits, that says how hard a password is to guess. You will see advice quoting different targets — 50 bits, 60 bits, 80 bits — and they disagree. This guide explains what entropy actually is, works through the maths in plain English, reconciles the conflicting targets by threat model, and tells you exactly what to aim for.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Entropy in plain English

Entropy measures uncertainty: how many guesses an attacker would need, on average, to find your password. It is measured in bits, and each bit doubles the number of possibilities. A password with 10 bits of entropy has about a thousand possible values; 20 bits, about a million; 30 bits, about a billion; 40 bits, about a trillion. The scale grows so fast that it is hard to picture — but the rule is simple: more bits means exponentially more guesses.

The practical way to think about it is in guesses. A password with 50 bits of entropy needs roughly a thousand trillion guesses to crack. That sounds enormous — and it is — but computers are fast, and a well-resourced attacker can try billions of guesses per second against a stolen password file. So the question is never just how many bits, but how many bits against whom, and for how long the password needs to survive.

Entropy is a property of how the password was chosen, not of how it looks. A password chosen randomly from a large set has high entropy. A password chosen by a person — a name, a date, a familiar phrase — has far less entropy than its length suggests, because attackers guess the likely choices first. That is the first thing to understand: entropy measures the guessing process, not the characters on the screen.

How entropy is calculated

The basic calculation is straightforward: take the size of the pool your password was drawn from, and the number of choices you made, and combine them. If each character is chosen randomly from 26 lowercase letters, each character adds about 4.7 bits of entropy, because two to the power of 4.7 is about 26. Eight random lowercase letters give about 38 bits. Use all 95 printable characters on a keyboard, and each character adds about 6.6 bits — eight of those give about 53 bits.

For passphrases made of words, the pool is the number of possible words. From a list of about 7,776 words — the size of a well-known diceware word list — each word adds about 12.9 bits, because two to the power of 12.9 is about 7,776. Four such words give about 52 bits; five give about 65 bits; six give about 77 bits. That is why a short passphrase of random words can be stronger than a complicated-looking password of symbols: the words carry more entropy per character than people expect.

The key word is random. These numbers only hold when the choices really are random — drawn by a generator, or by dice. Four words you chose because you like them are not four random words. An attacker will try pet names, dates, song lyrics, sports teams and common phrases before they ever start on random combinations. Human choice collapses entropy, which is why generated passwords and diceware passphrases are recommended over invented ones.

Why the advice disagrees: 50, 60 and 80 bits

Search for a recommended target and you will find three figures: 50 bits, 60 bits and 80 bits. Each comes from a different source making different assumptions, and none of them is wrong on its own terms. The confusion is that they are rarely presented with their assumptions attached. Here is each figure, with its context.

The 50-bit figure is commonly cited in password-strength guidance aimed at ordinary users, as a reasonable minimum for an online account protected by rate limiting — a service that slows or blocks repeated login attempts. The reasoning is that an attacker trying passwords through the login page, rather than against a stolen file, can only try a limited number of guesses before being locked out or slowed down, so 50 bits is comfortably beyond reach in that setting.

The 60-bit figure appears in guidance aimed at a stronger setting: a password that must survive offline cracking, where an attacker has a copy of the password file and can try billions of guesses per second without any rate limit. In that setting, 50 bits is considered thin, and 60 bits is the floor that buys meaningful time against a well-resourced attacker with modern hardware.

The 80-bit figure comes from the strongest setting of all: guidance written for high-value secrets — encryption keys, master passwords, and credentials that must survive for years against a determined, well-funded attacker. It is quoted in older cryptographic guidance and in some password-manager documentation as a long-term target. It is a different kind of number: a safety margin for the worst case, not a minimum for a shopping account.

None of these figures is settled fact, and they should not be presented as if one of them were the answer. They are three answers to three different questions: how strong against an online attacker, how strong against an offline attacker, and how strong against the worst plausible attacker over a long time. The honest reconciliation is the threat model, which is the next section.

Reconciling the figures: the threat model

A threat model is simply a clear statement of who you are defending against and what they can do. Once you state it, the right entropy target follows. For an ordinary online account — email, shopping, social media — the realistic threat is online guessing and credential stuffing, and the account is protected by the service's own rate limiting and by two-factor authentication. In that setting, a password of around 50 bits, used once and paired with a second factor, is a sensible floor.

For a password that protects a stolen database — which means, in practice, any password on a service that might be breached — the threat is offline cracking against a leaked password file, with no rate limiting. Here, the 60-bit figure is the sensible target, because a modern attacker with graphics hardware can try billions of guesses per second, and 50 bits would fall within a feasible time for a determined attacker.

For the few passwords that protect everything else — your password manager's master password, your email account, your device encryption — the threat is a determined attacker with years to work, and the cost of failure is total: every account you own. Here, aim for 80 bits or more. A master password of six random words, or a long generated passphrase, reaches that range, and it is the one place where the extra effort is worth it.

This is also why current NIST guidance, SP 800-63B Revision 4 (July 2025), does not set a single entropy target, but instead sets a length floor: 15 characters for a password used on its own, 8 characters when it is one factor of multi-factor sign-in, and acceptance of at least 64 characters. Length is the lever a user can control directly; entropy is the measure that follows from it when the password is random. Last checked: 14 November 2026.

What this means in practice: length and randomness

Convert the targets into passwords you can actually use. A randomly generated password of 15 characters drawn from all printable characters carries about 98 bits of entropy — far beyond any of the three targets — which is why a password manager that generates 15-plus character passwords solves the problem completely for ordinary accounts. You do not need to calculate anything: generate, store, and forget.

A passphrase of five random words from a 7,776-word list carries about 65 bits — meeting the offline-cracking target. Six random words carry about 77 bits — close to the 80-bit target. Four words carry about 52 bits — enough for an ordinary online account with a second factor, but thin for a master password. The pattern is clean: four words for everyday accounts, five or six for the important ones, and a generated password wherever the manager can fill it in.

The most common mistake is inventing a password by hand and assuming it is strong because it looks complex. A password such as a name with a capital, a number and a symbol has far less entropy than its appearance suggests, because attackers try exactly those patterns first. Randomness is the ingredient that matters, and randomness comes from a generator or from dice — not from cleverness.

• Four random words: about 52 bits — an ordinary account with a second factor.
• Five random words: about 65 bits — the offline-cracking target.
• Six random words: about 77 bits — near the high-value target.
• Fifteen random characters: about 98 bits — beyond every target.
• Invented passwords are always weaker than they look. Generate instead.

Entropy is not the whole story

Entropy measures guessing difficulty, and guessing is only one way passwords are stolen. A password with enormous entropy is still worthless if it is captured by phishing, stolen from a breached service, or reused across accounts. That is why the fundamentals matter more than the number: unique passwords per account, a password manager to generate and store them, and two-factor authentication on the accounts that matter most.

Entropy also matters less for accounts protected by rate limiting, and more for passwords on services that store them poorly. You cannot control how a service stores your password — some use strong, slow hashing that makes offline guessing expensive, others do not. Since you cannot see that, the safe assumption is that any password may one day be attacked offline, and the 60-bit target is the right default for anything you choose yourself.

Finally, remember that entropy is a measure of a process, not a property of a string. No checker can tell you the true entropy of a password it did not watch you create, because it cannot know whether you chose it randomly or picked your dog's name. Strength checkers estimate, and their estimates assume randomness. If you typed a meaningful password, the true entropy is lower than the checker says — sometimes much lower.

Your entropy targets, summarised

For an ordinary online account with two-factor authentication, aim for at least 50 bits — a four-word passphrase, or any generated password of 12 characters or more. For a password that must survive a breach and offline cracking, aim for 60 bits or more — a five-word passphrase, or a generated password of 15 characters. For your master password and your email account, aim for 80 bits or as close as you can — six random words, or a long generated passphrase.

If those numbers feel abstract, there is a simpler rule that covers all of them: use a password manager, let it generate a long random password for every account, and remember one long passphrase for the vault itself. Then the entropy takes care of itself, the uniqueness takes care of itself, and you only have to remember one thing.

The argument about 50, 60 and 80 bits will continue, because each figure answers a different question. You do not need to pick a side. State your threat model, choose the target that matches it, and let a generator do the work. That is the whole lesson of entropy.

Sources

• NIST — SP 800-63B Revision 4, Digital Identity Guidelines — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Password guidance — last checked 14 November 2026.
• CISA — Cybersecurity best practices — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is password entropy in simple terms?

Password entropy is a measure of how hard a password is to guess, counted in bits. Each bit doubles the number of possible passwords, so a password with more bits needs exponentially more guesses to crack. It measures how the password was chosen, not how it looks.

How many bits of entropy should a password have?

It depends on the threat: about 50 bits is a sensible floor for an ordinary online account with two-factor authentication; about 60 bits is the target for a password that must survive offline cracking after a breach; about 80 bits is the target for a master password or email account. No single figure is settled fact — each comes from different assumptions.

How many bits are in a four-word passphrase?

If the words are chosen randomly from a list of about 7,776 words, each word adds about 12.9 bits, so four words give about 52 bits and five words give about 65 bits. The numbers only hold when the words are genuinely random — chosen by a generator or by dice, not picked because you like them.

Is a longer password always stronger?

Not always. Length helps only when the extra characters are unpredictable. A long password made of a familiar phrase is weaker than a shorter one made of random characters, because attackers guess familiar phrases first. Randomness matters as much as length.

Can a strength checker tell me my password's entropy?

Only approximately. A checker cannot know whether you chose a password randomly or picked a meaningful phrase, so it assumes randomness. If you typed a meaningful password, its true entropy is lower than the checker says — sometimes much lower.