In more detail
Each bit doubles the number of guesses an attacker needs. A truly random password of n characters from an alphabet of k symbols has n × log2(k) bits; for example 12 random characters from 94 printable symbols is about 79 bits. Human-chosen passwords have far less entropy than their length suggests, which is why random generators and long passphrases are recommended. The formula only applies when every symbol is picked uniformly at random; a word with digits added at the end is judged by how attackers actually guess, not by its character set.
Why it matters
Entropy is the honest way to compare passwords and passphrases: it measures the generator, not how strange the result looks. About 70 to 80 bits of real randomness puts offline Brute-force attack out of reach for a password stored with a decent hash. Strength meters that only count character classes overrate patterns like Summer2026!.
Example
| Secret | Calculation | Entropy |
|---|---|---|
| 4-digit PIN | 4 × log2(10) | 13.3 bits |
| 12 random printable characters | 12 × log2(94) | 78.7 bits |
| 4 Diceware words | 4 × log2(7776) | 51.7 bits |
| 6 Diceware words | 6 × log2(7776) | 77.5 bits |
Six random words are as strong as twelve random symbols and much easier to type. Generate one with the Diceware Passphrase Generator.
Common confusion
In file analysis "entropy" means Shannon entropy of the bytes, from 0 to 8 bits per byte. Values near 8 point to compressed or encrypted data, a sign of a Packer; that is a property of data, not of how a password was chosen.