Glossary
Password entropy
Password entropy is the measure of how hard a password is to guess, counted in bits.
What it means
Password entropy is the measure of how hard a password is to guess, counted in bits. Each extra bit doubles the number of guesses an attacker would need, so a password with 60 bits of entropy is roughly a billion times harder to crack than one with 30 bits. Entropy is the number that matters, not the number of characters: it is the number of possibilities, not the length on its own, that protects you — though length creates possibilities faster than complexity does.
How it works
Entropy depends on two things: the size of the set of characters a password could contain, and the length the attacker must search. A four-word passphrase drawn from a list of several thousand words has far more possibilities than an eight-character password with symbols, because each word adds far more entropy than each symbol does. The advice about how many bits you need disagrees — 50, 60 and 80 bits are all quoted — because the right target depends on what the password protects, how fast an attacker can guess, and how long the password must stay safe. A password for a rarely used forum, attacked slowly through a website, needs less entropy than a master password stored as a hash that an attacker can test billions of times a second. The honest way to state a target is always with the threat model attached.
Example
Imagine two fictional passwords. The first is Tr0ub4dor! — eleven characters, mixed capitals, a number and a symbol. The second is correct-horse-battery-staple — four random words, twenty-eight characters. The first looks stronger and is far easier to remember as weaker: it has roughly 28 bits of entropy, which a fast attacker can exhaust quickly. The second has around 44 bits from the words alone, and is easier to remember — the famous example that gave this lesson its shape. Length wins, and this example is why: each word adds more guessing work than each symbol ever could.
Common misunderstandings
The most common misunderstanding is that complexity equals entropy. It does not: the tricks people use to satisfy complexity rules — a capital at the start, a number at the end, an exclamation mark — are the first things attackers try, because everyone uses them. A password's entropy comes from unpredictability, not from the variety of characters on its surface. Four random words are unpredictable; Password123! is entirely predictable, whatever it looks like.
Related terms
Learn more
- What is password entropy?
- Password security fundamentals
- Encryption vs hashing
- Encryption Fundamentals Path
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
How many bits of entropy should my password have?
It depends on what it protects. Common targets are 50, 60 and 80 bits, and they disagree because they assume different attackers. A long passphrase of random words reaches the high targets comfortably; a short complex password does not. Your master password and email password deserve the most entropy.
Is a longer password always better?
If the extra length is random or made of random words, yes — each extra bit doubles the guessing work. But length made of predictable text, like a sentence from a famous book, adds far less than it looks. Entropy comes from unpredictability, not from length alone.
How can I work out the entropy of my password?
Our password entropy calculator does it in your browser: it takes a password's length and character set and shows the bits, with the threat-model explanation of why the targets disagree. Nothing you type leaves your device.