Password Entropy
Bits of security from password length and character-set size.
Formula
Variables
Example
12 chars from 95 printable: H = 12 log2(95) ≈ 78.8 bits
How it works
Password entropy estimates how many bits of uncertainty an attacker faces when a password is chosen from a known set of possible characters. If each of the L positions can be filled independently from R choices, there are R^L possible passwords; taking log2 turns that count into bits, since each added bit doubles the number of possibilities. Higher length and a larger character set both increase the search space, which is why long passwords made from many character types are much harder to guess or brute-force.
When to use it
Use this when comparing password strength, estimating brute-force resistance, or designing password policies. It is also helpful in security training to show how changing length or allowed characters affects the number of possibilities.
Worked example, step by step
Suppose a password is 10 characters long and each character is chosen from 62 possibilities (uppercase letters, lowercase letters, and digits). H = L log2 R H = 10 log2(62) log2(62) ≈ 5.954 H ≈ 10 × 5.954 H ≈ 59.5 bits So the password has about 59.5 bits of entropy.
Common mistakes to avoid
- Using the number of words or symbols directly instead of multiplying by the password length in the exponent form
- Assuming entropy guarantees security even if the password is reused, leaked, or based on a pattern
- Forgetting that the character set size R must match the characters actually allowed by the system
Did You Know?
Every extra random character adds about 6.6 bits — length beats complexity for strong passwords.
Share this formula
More in Cryptography & Security
View allModular Exponentiation
IntermediateCore operation of RSA encryption — raise a message to a power, modulo n.
RSA Decryption
AdvancedRecovers the message using the private exponent d.
Euler's Totient
IntermediateCounts integers below n coprime to it, for n = pq — used to make RSA keys.
Shannon Entropy
AdvancedAverage information content — and the theoretical strength of a random source.
Key Space Size
IntermediateNumber of possible keys for a b-bit key.
Birthday Bound
AdvancedCollisions become likely after about √ of the hash space.