What is password entropy? How to measure password strength in bits
Entropy is the technically correct way to measure password strength, but remember that human-chosen passwords always have lower entropy than their length suggests. Randomness generators give you the entropy you paid for. Humans don't.
Password entropy measures password strength in bits, representing the logarithm (base 2) of the number of possible combinations. A truly random 8-character password from a 95-character set has log2(95^8) ≈ 52 bits of entropy. Adding one bit of entropy doubles the attacker's work. 2^28 (28 bits) is trivial. 2^50 (50 bits) is moderate. 2^80 (80 bits) is strong against any attacker.
By TechCompare · Updated
How this is calculated
Entropy calculation assumes the password is truly random. Human-chosen passwords have far less entropy than their length suggests because humans are bad at randomness. The password 'Tr0ub4dor&3' looks strong but was generated by a human following predictable patterns (capitalize first letter, common substitutions 0→o, 4→a, & for a, append a symbol and number). Its actual entropy against a targeted attack is much lower than the theoretical 52 bits. The only way to get full entropy is to generate passwords randomly, either from a password manager or with dice for passphrases. This is why password managers that generate random strings give you more security per character than human-chosen passwords of the same length.
Verdict
Entropy in bits is log base 2 of the keyspace, so a truly random 8-character password from 95 printable ASCII characters carries about 52 bits. The trap is human patterns. 'Tr0ub4dor&3' looks strong but follows predictable rules (capitalize first, 0 for o, 4 for a, append a symbol and number), so a targeted attack extracts far fewer bits than the math suggests. Only a password manager or dice gives you the entropy the character count implies.
More Passwords scenarios
Related guides
Frequently asked questions
How do I calculate password entropy in bits?
Is 50 bits of entropy enough?
Why is my 'strong-looking' password's entropy lower than the math says?
Related tools
CHMOD Configurator
Calculate Linux file permissions using checkboxes or octal numbers, then view the matching symbolic notation.
Use tool ➜Text Encoding Converter
Convert between Text, Base64, Binary, Hexadecimal, and Decimal formats.
Use tool ➜Cron Generator
Visually build standard 5-part cron expressions or translate them into readable schedules.
Use tool ➜