Password Entropy Explained
Understand password entropy in bits, why estimates depend on random selection, and why crack-time calculators have limitations.
What does entropy mean?
In password generation, entropy describes uncertainty in the random selection process. If there are N equally likely possibilities, the selection entropy is log₂(N) bits. It is not a guarantee that a password cannot be stolen or cracked.
A simple word example
If a generator independently picks five words uniformly from a list of 2,048 words, there are 2,048⁵ possibilities. That corresponds to 55 bits of entropy. The estimate changes if words are filtered, biased, reused, or chosen by a person instead of a random generator.
A character example
If each character is selected independently and uniformly from an alphabet of 64 characters, a 20-character password has 20 × log₂(64) = 120 bits of selection entropy. Real generators must actually use unbiased random selection for that calculation to apply.
Why cracking-time estimates vary
Offline attacks depend on password-hash algorithms, hardware, attacker resources, and whether an attacker knows the generation method. Online login attacks are often rate-limited or protected by additional checks. A single time estimate without assumptions can be misleading.
What entropy cannot measure
Entropy does not protect against phishing, malware, credential reuse, compromised password managers, or poor account recovery practices. Use unique credentials and additional authentication protections.
Try it yourself
Generate a new random password or passphrase with SecurePassLab.
Open the free password generator →Related reading: All password security guides.