◈ TOOLFORGE
TOOLFORGE/BLOG/SECURITY
SECURITY

Password Entropy Explained: What Makes a Password Truly Strong

Security experts measure password strength in bits of entropy. Here's what that actually means, why it matters, and how to hit the threshold that makes brute-force attacks impossible.

#password entropy#password strength#cryptography#security

What Is Entropy?

In information theory, entropy measures unpredictability. A password with high entropy has many possible values — making it hard to guess. A password with low entropy follows patterns that attackers can exploit.

Password entropy is measured in bits. Each bit doubles the number of possible passwords an attacker must try.

The Formula

Entropy (bits) = log₂(charset_size) × password_length

Where charset_size is the number of unique characters the password could use.

CharsetSize
Lowercase only (a–z)26
+ Uppercase (A–Z)52
+ Digits (0–9)62
+ Common symbols~94

Entropy by Password Type

PasswordCharsetLengthEntropy
password26 (lowercase)837.6 bits
P@ssw0rd!94959.2 bits
Random 12-char mixed941278.9 bits
Random 20-char mixed9420131.5 bits
6-word passphrase7,776 (word list)6 words77.5 bits

How Many Bits Do You Actually Need?

This depends on what's attacking you:

  • Online attack (web login, rate-limited): 40+ bits is sufficient. Lockouts and rate limits make brute force impractical.
  • Offline attack (stolen hash, fast GPU): You need 80+ bits. Modern rigs crack billions of hashes per second.
  • Critical accounts (email, banking, password manager): 100+ bits. These are highest-value targets.
For most accounts stored in a password manager, 80–100 bits is a practical minimum. For your password manager's master password — which you need to memorize — a 6-word passphrase (~77 bits) is often the better tradeoff between security and memorability.

Why "Complex" Short Passwords Are Worse Than Long Simple Ones

P@ss1! (6 chars, full charset, 94 symbols): 39.5 bits correcthorsebatterystaple (25 chars, lowercase only): 117 bits

Complexity requirements that force short "complex" passwords are actively harmful. Length wins.

The Practical Takeaway

  • Use a password generator with a full charset (94 characters)
  • Set minimum length to 20 characters for managed passwords
  • Set minimum length to 6 words for memorized passphrases
  • Use the entropy readout in ToolForge's Password Generator to verify — aim for 100+ bits on anything important
The math is unambiguous. At 100+ bits of entropy, your password cannot be cracked by any attacker with any realistic amount of computing power.


// MORE ARTICLES