Loading…
Password entropy measures how hard a secret is to guess, in bits. Here is the formula, why Password1! fails it, and how to generate something strong.
A hash is a fixed-length fingerprint of data. Here is how MD5 and SHA-256 differ, why fast hashes are wrong for passwords, and what HMAC adds.
10 min read
A JWT is a signed bundle of JSON claims. Here is how to read one, why decoding is not verifying, and how to check for the classic JWT security flaws.
9 min read
Password entropy is a measure of how hard a password is to guess, counted in bits. Each bit doubles the number of guesses an attacker might need. The catch is that entropy belongs to how the password was made, not to the string on your screen. A random 12-character password and Password1! can look similar to a meter, but they're nowhere near each other in practice.
Want to check or make one? The Password Strength & Entropy Checker scores a candidate. The Entropy Calculator shows Shannon entropy and character classes. The Password Generator makes a random one. Use test strings when you're just experimenting.
The outputs below were captured on 13 October 2026 (IST) on a Linux box with Python 3.13.5. Every password and passphrase shown is a throwaway generated for this article. Don't use them.
If a secret is picked uniformly at random from N equally likely options, its entropy is log2(N) bits. An attacker who knows exactly how it was made has to try up to N guesses, and about half of that on average.
A 4-digit PIN has 10,000 options:
4-digit PIN: 13.29 bits
Every extra bit doubles the search space. That's why entropy is on a log scale: 60 bits isn't "a bit more" than 50 bits, it's about a thousand times more guesses.
For a password of length L where each character is picked uniformly from a pool of N characters:
E = L × log2(N)
Here are the numbers, computed on the box:
python3 -c "
from math import log2
print('4-digit PIN:', round(log2(10**4), 2), 'bits')
for name, L, N in [('8 lowercase', 8, 26), ('12 printable ASCII', 12, 95), ('20 printable ASCII', 20, 95), ('16 lowercase', 16, 26)]:
print(f'{name}: {L} x log2({N}) = {L * log2(N):.2f} bits')
print('one EFF word:', round(log2(7776), 2), 'bits')
for w in (4, 5, 6, 7):
print(f'{w} EFF words: {w * log2(7776):.2f} bits')
print('extra bit doubles:', 2**61 // 2**60)
"
4-digit PIN: 13.29 bits
8 lowercase: 8 x log2(26) = 37.60 bits
12 printable ASCII: 12 x log2(95) = 78.84 bits
20 printable ASCII: 20 x log2(95) = 131.40 bits
16 lowercase: 16 x log2(26) = 75.21 bits
one EFF word: 12.92 bits
4 EFF words: 51.70 bits
5 EFF words: 64.62 bits
6 EFF words: 77.55 bits
7 EFF words: 90.47 bits
extra bit doubles: 2
The 95 is the printable ASCII set including space. Look at the 16-lowercase line: 75 bits from letters alone, close to 12 characters drawn from all 95. Length is the cheap lever.
Generating one properly is short. Python's secrets module is "used for generating cryptographically strong random numbers suitable for managing data such as passwords". Don't use random. Here's a 20-character password from letters and digits:
python3 -c "
import secrets, string
from math import log2
pool = string.ascii_letters + string.digits
print(len(pool), 'chars in pool,', f'{20 * log2(len(pool)):.2f} bits for 20')
print(''.join(secrets.choice(pool) for _ in range(20)))
"
62 chars in pool, 119.08 bits for 20
h5UWuDAT3hXeDmXBUk9x
The formula only holds because secrets.choice picks every character independently and uniformly. That's the whole condition.
There's a second thing called entropy that people mix up with this one. Shannon entropy of a string measures how varied its characters are. It doesn't know about dictionaries, keyboards or the word "password".
python3 -c "
from collections import Counter
from math import log2
def shannon(s):
c = Counter(s)
return abs(len(s) * sum(n / len(s) * log2(n / len(s)) for n in c.values()))
for s in ['Password1!', 'qwertyuiop', 'aaaaaaaaaa']:
print(f'{s}: Shannon {shannon(s):.2f} bits, pool formula {len(s) * log2(95):.2f} bits')
"
Password1!: Shannon 31.22 bits, pool formula 65.70 bits
qwertyuiop: Shannon 33.22 bits, pool formula 65.70 bits
aaaaaaaaaa: Shannon 0.00 bits, pool formula 65.70 bits
The pool formula column is what you'd get by wrongly assuming each string was drawn at random from all 95 characters. Both numbers are misleading for the first two. Password1! and qwertyuiop are among the first things any guesser tries, and neither measure sees that.
So which tool is for what? The Entropy Calculator gives the Shannon and character-class view of a string. That's useful for checking whether a key or token looks random. The Password Strength & Entropy Checker is the one to use on a password candidate, because it also warns about patterns.
People don't pick characters uniformly. We use words, names, dates, keyboard walks and the same few substitutions. NIST says it directly in SP 800-63B-4, Appendix A: "estimating entropy for user-chosen passwords is challenging", and attackers "are likely to guess passwords that have previously proven successful. These include dictionary words and passwords from previous breaches, such as the "Password1!" example above."
That's why serious strength meters model patterns instead of counting character classes. The zxcvbn paper (Dropbox, USENIX Security 2016) calls classic "LUDS" rules (lowercase, uppercase, digits, symbols) "a conclusively burdensome and ineffective security practice." zxcvbn instead estimates how many guesses a pattern-aware attacker would need.
The takeaway: the E = L × log2(N) number is an upper bound that only applies to randomly generated secrets. For anything a human chose, it's usually an overestimate, sometimes by a lot.
"Must include an uppercase letter, a digit and a symbol" sounds strong. In practice it produces predictable shapes like Password1! and Summer2026!. NIST Appendix A: "users respond in very predictable ways to the requirements imposed by composition rules."
The current NIST rules, SP 800-63B-4 §3.1.1.2, quoted:
NIST also requires checking new passwords against a blocklist of commonly used, expected or compromised values. SP 800-63B-4 is the final revision, published July 2025 (status page at csrc.nist.gov/pubs/sp/800/63/b/4/final), and it replaces the 2017 SP 800-63B (updated 2020). The OWASP Authentication Cheat Sheet follows the same line: no composition rules, and a maximum of at least 64 characters "to allow passphrases".
A passphrase made of random words follows the same formula, with N set to the size of the word list. The EFF dice wordlist has 7,776 words (six-sided dice, five rolls per word). EFF's own write-up says "each additional word will strengthen the passphrase by about 12.9 bits", which matches the 12.92 above. Six words is about 77.5 bits.
Here's one generated with secrets from the EFF list (downloaded to the box; 7,776 lines):
python3 -c "
import secrets
words = [line.split()[1] for line in open('eff_large_wordlist.txt')]
print(len(words))
print(' '.join(secrets.choice(words) for _ in range(6)))
"
7776
washroom starry glaucoma scribble swampland pampers
Two rules make the math true. The words must be picked at random, not chosen by you. And the phrase must be new: a passphrase that's been printed anywhere (a comic, a blog post, this article) is now in someone's guess list, whatever its formula says. The Password Generator handles the random-character case if you'd rather not use dice.
Where the attacker is guessing matters as much as the bits.
That second half is about storage, not the password itself. I covered it in What Is Hashing?, including why SHA-256 alone is the wrong tool. Strong storage and a high-entropy secret work together; neither saves the other.
There's no official number, so treat these as rules of thumb. The strength checker's own FAQ says roughly 60+ bits resists online attacks and 80+ bits resists offline cracking of a properly hashed password. Numbers in that range only mean something for randomly generated secrets. From the table above:
For anything a password manager fills in, there's no reason not to go long. For something you have to type, a random passphrase is the easiest way to get there. If you're setting up a fresh Kali box, the Kali default password and user management guide covers changing the defaults.
No. Complexity is what characters a password contains. Entropy is how many equally likely options the generation process had. Password1! is "complex" and still near the top of every guess list.
As a rule of thumb, 60+ for an account protected by rate limiting, and 80+ for anything that could be attacked offline. Those figures assume the secret was randomly generated.
They're easier to type and remember for the same entropy, as long as the words are chosen randomly from a large list. Six random EFF words (about 77.5 bits) is similar to 12 random printable characters (about 79 bits).
Use it to learn, not as proof. Meters that only count character classes overestimate human-chosen passwords. Our tool pages say the analysis and generation run in your browser and nothing is sent, but the safe habit is the same everywhere: test with throwaway strings, not your real passwords.
No. Once one site leaks it, the entropy is gone everywhere you used it. Use a unique password per account, a password manager, and MFA where you can.
Share this article
An IPv4 address is one 32-bit number. Here is how to read it as decimal, hex, binary or integer, size a CIDR block, and spot private ranges.
9 min read
Sign in to leave a comment.