Password entropy explained
Password entropy estimates how difficult a secret is to guess, measured in bits. It depends on the size of the possible character set and the number of random choices.
Quick answer
Password entropy estimates, in bits, how many candidates a search might need to consider under a chosen model. For a uniformly random password of length L from an alphabet of N equally likely characters, the simple estimate is L × log₂(N). (NIST definition of entropy)
Why does randomness matter?
The formula assumes every character was chosen independently and uniformly. Human-chosen passwords often follow words, dates, keyboard patterns, or reused phrases, so their guessability can be much higher than a simple character-set calculation suggests. NIST’s current digital identity guidance discourages arbitrary character-composition rules and emphasizes other controls. (NIST SP 800-63B-4)
Does entropy tell you how long a password will take to crack?
Not by itself. A time estimate also needs assumptions about attack rate, password hashing, attacker hardware, and breach exposure. Online login limits and offline hash cracking are different situations.
How should you use an entropy calculator?
Treat the result as an educational estimate, not a pass/fail guarantee. Prefer long, unique passwords generated randomly and stored in a password manager; use multifactor authentication where available. (Try the entropy calculator with a made-up password)