What is Password Entropy?
In cybersecurity, entropy is a mathematical measurement of a password's unpredictability and randomness, expressed in bits. The higher the entropy value, the more guesses a brute-force attack algorithm requires to crack the password. Entropy accounts for both password length and the diversity of character sets used.
The Password Entropy Formula
Password entropy is calculated using information theory formulas:
Entropy (E) = L × log2(R)
Where L is password length and R is the pool size of available characters:
- Lowercase letters (a-z): 26 pool size
- Uppercase + Lowercase (a-z, A-Z): 52 pool size
- Alphanumeric (a-z, A-Z, 0-9): 62 pool size
- Full ASCII printable symbols: 94 pool size
Entropy Security Thresholds
| Entropy Level | Security Rating | Estimated Crack Time (100 Billion/sec) |
|---|---|---|
| < 40 bits | Very Weak | Instant to a few minutes |
| 40 - 60 bits | Moderate | A few hours to several days |
| 60 - 80 bits | Strong | Several months to decades |
| > 128 bits | Cryptographically Unbreakable | Trillions of universe lifetimes |
Generate Uncrackable Passwords Online
Instead of manually counting characters and calculate bit pools, use our free online Password Generator. It uses browser-native crypto.getRandomValues() API calls to construct high-entropy strings locally inside your browser with real-time strength indicators.