How to calculate password entropy

6 October 2026 · Calcosmo editorial team

Password entropy measures how hard a password is to guess, in bits. For a randomly generated password, the formula is length × log2(number of possible characters). A 12-character password using upper and lower case letters, digits and symbols (94 characters) has 12 × 6.55 ≈ 79 bits. The password generator shows the entropy of every password it creates.

The formula

E = L × log2(N)

• L is the length of the password;
• N is the size of the character set the characters are drawn from;
• E is the entropy in bits.

Equivalently, the number of possible passwords is N^L, and the entropy is log2 of that number. Each extra bit doubles the number of guesses an attacker needs.

Character set sizes

Entropy by length

Length wins: a 16-character password of letters and digits (95 bits) is far stronger than a 12-character password with symbols (79 bits).

From bits to cracking time

On average, an attacker has to try half of all possibilities: 2^(E−1) guesses. At 10 billion guesses per second, which fast graphics cards can reach against weak password hashes:

• 52 bits: about 3.5 days
• 66 bits: about 80 years
• 79 bits: hundreds of thousands of years
• 95 bits: far longer than the age of the universe

Sites that store passwords properly use slow hash functions such as bcrypt or Argon2, which cut the guessing rate by many orders of magnitude. But you rarely know how a site stores your password, so it is wise to assume the worst.

Entropy only applies to random passwords

The formula assumes every character is chosen uniformly at random. Human-made passwords are not. "Summer2026!" is 11 characters from the 94-character set, so the formula says 72 bits, but attackers try dictionary words, years and common patterns first and will crack it in seconds. Its real entropy is a small fraction of 72 bits.

For passphrases, count words instead of characters. With a list of 7,776 words (the Diceware list), each randomly chosen word adds log2(7,776) ≈ 12.9 bits. Four words give about 52 bits, six words about 78 bits.

How much entropy do you need?

• 60 bits or more for everyday online accounts protected by rate limiting.
• 80 bits or more for anything an attacker could attack offline: your password manager's master password, disk encryption, important email accounts.
• 128 bits is the level of modern encryption keys and is overkill for passwords, but a random 20-character password gets you there.

Practical rules

• Use a different password for every site, so one breach doesn't expose the others.
• Let a password manager generate random passwords of 16 characters or more.
• Turn on two-factor authentication wherever it is available.