What is password entropy? How to measure password strength in bits

Entropy is the technically correct way to measure password strength, but remember that human-chosen passwords always have lower entropy than their length suggests. Randomness generators give you the entropy you paid for. Humans don't.

Password entropy measures password strength in bits, representing the logarithm (base 2) of the number of possible combinations. A truly random 8-character password from a 95-character set has log2(95^8) ≈ 52 bits of entropy. Adding one bit of entropy doubles the attacker's work. 2^28 (28 bits) is trivial. 2^50 (50 bits) is moderate. 2^80 (80 bits) is strong against any attacker.

By TechCompare · Updated August 2026

Security domain

Fundamentals

How passwords and hashing work

Topic focus

Password entropy

password-entropy

How this is calculated

Entropy calculation assumes the password is truly random. Human-chosen passwords have far less entropy than their length suggests because humans are bad at randomness. The password 'Tr0ub4dor&3' looks strong but was generated by a human following predictable patterns (capitalize first letter, common substitutions 0→o, 4→a, & for a, append a symbol and number). Its actual entropy against a targeted attack is much lower than the theoretical 52 bits. The only way to get full entropy is to generate passwords randomly, either from a password manager or with dice for passphrases. This is why password managers that generate random strings give you more security per character than human-chosen passwords of the same length.

Verdict

Entropy in bits is log base 2 of the keyspace, so a truly random 8-character password from 95 printable ASCII characters carries about 52 bits. The trap is human patterns. 'Tr0ub4dor&3' looks strong but follows predictable rules (capitalize first, 0 for o, 4 for a, append a symbol and number), so a targeted attack extracts far fewer bits than the math suggests. Only a password manager or dice gives you the entropy the character count implies.