# What is Password entropy?

> A measure of how many guesses an attacker needs to find a password, expressed in bits, where each bit doubles the work.

Last reviewed: 2026-09-01

## Password entropy

Category: Passwords

Also called: entropy of a password, bits of entropy

Canonical page: https://moolkey.com/glossary/password-entropy

Password entropy measures how unpredictable a password is, expressed in bits. Each additional bit doubles the number of guesses an attacker needs. For a randomly generated password, entropy equals the length multiplied by log2 of the pool size. A 12-character password drawn from 86 possible symbols carries 77 bits.

### How password entropy is calculated

The formula is `entropy = length x log2(pool size)`. Pool size is the number of distinct symbols each position could hold: 10 for digits, 26 for lowercase letters, 62 for alphanumerics, and around 86 once a typical symbol set is included.

For a passphrase the same formula applies with words in place of characters. Five words drawn at random from the 1,296-word EFF list gives 5 x log2(1296) = 51.7 bits.

### How many bits are enough

Below 45 bits offers little margin against fast offline guessing. Between 60 and 80 bits is a practical target for randomly generated secrets. Above 100 bits, brute force is unlikely to be the limiting risk; phishing, malware, and password reuse usually matter more.

### What people often get wrong

Claim: "My password has 70 bits of entropy because it is 11 characters long."

Correction: The formula only holds for passwords chosen at random. Tr0ub4dor&3 calculates to 70 bits but is worth closer to 28 in practice, because attackers guess a dictionary word plus standard substitutions rather than character by character.

Further reading: [Calculate the entropy of any password](https://moolkey.com/tools/password-entropy-calculator)

### Sources

- [EFF: Dice-generated passphrases](https://www.eff.org/dice): Wordlists and a verifiable method for choosing passphrase words at random.
- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.