Home/Computer Science/Password Entropy (Bits of Security)

Formula & Calculator

Password Entropy (Bits of Security)

Estimates the strength of a password in bits, based on its length and the size of the character set used.

Written by the Vorzep Team

Computer ScienceCryptographyDaily Life

Password Entropy (Bits of Security) CalculatorE = L · log₂(N)

Entropy (bits) = Length × log₂(Character Set)
Select what to solve for — enter the other two values, then click Check
Solve for:
bits
chars
—
Quick:
Entropy Strength—
Weak (<30) Moderate (30–60) Strong (60–80) Very Strong (>80)
Entropy (bits) = Length × log₂(Character Set) · Recommended: ≥ 60 bits

Variables

SymbolQuantityUnit
EntropyPassword entropybits
LPassword lengthcharacters
NSize of character set used

What it means

Password entropy is a measure of the unpredictability of a password, expressed in bits. It quantifies the number of guesses required on average to crack the password via brute force. The entropy is calculated as E = L × log₂(N), where L is the length of the password and N is the number of possible characters (e.g., 26 lowercase, 52 alphanumeric, 95 printable ASCII). Higher entropy means exponentially more combinations to test. For example, an 8‑character password with 95 characters yields about 52.6 bits of entropy, meaning 2^52.6 ≈ 6.5 × 10^15 possible passwords. In practice, a minimum of 80 bits is recommended for security. The formula guides password policy creation: longer passwords and larger character sets increase entropy. However, dictionary attacks and common patterns reduce effective entropy. Understanding entropy helps in evaluating password strength and in designing authentication systems. It is also used in cryptographic key generation.

Worked example

Password Entropy – Two Examples

Real‑World
Scenario 1 – Simple Password: A password has 8 lowercase letters (a‑z). What is its entropy?
ParameterValue
L (length)8
N (character set)26
1Entropy = L × log₂(N) = 8 × log₂(26) ≈ 8 × 4.70 = 37.6 bits
Result 37.6 bits ⚠️ Weak – crackable
Scenario 2 – Strong Password: A 12‑character password using upper/lower/digits/symbols (94 characters). What is its entropy?
ParameterValue
L (length)12
N (character set)94
1Entropy = 12 × log₂(94) ≈ 12 × 6.55 = 78.6 bits
Result 78.6 bits ✓ Strong – 2^78.6 combinations
Key insight: Aim for at least 60‑80 bits of entropy for secure passwords – longer length and larger character sets increase entropy.

Common mistakes

  • Character set size N: Count the number of possible characters (e.g., 26 for lowercase, 52 for mixed case, 95 for printable ASCII).
  • Log base: Use log₂ (base‑2) to get bits.
  • Length L: The password length; longer passwords increase entropy linearly.
  • Entropy vs. security: Higher entropy means stronger resistance to brute‑force, but does not protect against other attacks (e.g., phishing).
  • Randomness: Entropy calculations assume truly random characters; predictable patterns reduce effective entropy.

Applications

Password entropy, measured in bits, is calculated as L × log₂(N), where L is the password length and N is the character set size. It quantifies the strength of a password against brute‑force attacks. Engineers use this formula to enforce password policies, to design authentication systems, and to educate users on choosing strong passwords. In security audits, entropy helps evaluate the resistance of passwords to cracking. Understanding this formula is also critical for implementing password hashing and key derivation functions, as well as for setting minimum complexity requirements. It is a fundamental concept in cybersecurity that directly impacts the security posture of any system.

  • Password policy design and enforcement
  • Authentication system security assessment
  • User education on password strength
  • Security audits and risk analysis
  • Design of password managers and generators