Entropy is a measure of uncertainty expressed in bits, calculated by the formula $H = -\sum p_i \log_2(p_i)$. This simplifies to $\log_2(N)$ only when all $N$ possible values are equally likely. For passwords and passphrases generated uniformly at random, you calculate it by multiplying the number of independent choices (length or word count) by the log base 2 of the size of the selection pool.
Why 'Strong' is Subjective but Entropy is Math
Terms like "strong," "secure," or "hard to guess" are marketing words that shift depending on who is selling you a product. Entropy is a fixed mathematical property. It measures uncertainty. If a system has 10 possible states, it has about 3.3 bits of entropy. If it has 1,000 possible states, it has about 10 bits.
For a uniformly random password, the entropy tells you the size of the search space. An attacker trying every possibility would need to make roughly $2^H$ guesses to exhaust the space, meaning they would find the correct value after about $2^{H-1}$ attempts on average. This allows you to compare a short, complex random string against a long, memorable passphrase on an equal footing. You stop asking "is this strong enough?" and start asking "does this have enough bits to survive the attack model I care about?"
The Core Formula: Log2 of Possibilities
The universal formula for calculating Shannon entropy in bits is:
$$ H = -\sum p_i \log_2(p_i) $$
Where $p_i$ is the probability of each possible outcome. However, for password generation, we almost always assume a uniform distribution, where every possible password is equally likely to be chosen. In this specific case, the formula simplifies significantly. If there are $N$ equally likely outcomes, the probability of each is $1/N$, and the entropy becomes:
$$ H = \log_2(N) $$
For passwords and passphrases, $N$ is calculated as the size of the pool of choices raised to the power of the number of items chosen.
For a password with independent characters chosen from a set of size $S$ with length $L$, the total combinations are $S^L$. Therefore, the entropy is:
$$ H = \log_2(S^L) = L \times \log_2(S) $$
For a passphrase made of $W$ words chosen from a dictionary of size $D$, the total combinations are $D^W$. The entropy is:
$$ H = W \times \log_2(D) $$
This distinction is critical. In a random character password, each character is an independent draw from the character set. In a passphrase, each word is an independent draw from the word list. The "pool" changes, but the math remains the same: you are counting how many times you can divide the total possibilities by two, assuming each outcome is equally likely.
Calculating Entropy for Random Character Passwords
Let’s calculate the entropy for a specific random password. Assume you generate a 12-character password using the standard ASCII printable character set. This set includes uppercase letters (26), lowercase letters (26), digits (10), and common symbols (32). The total size of the character set ($S$) is 94.
Using the formula $H = L \times \log_2(S)$:
- Determine the character set size: $S = 94$.
- Calculate the log base 2 of the set size: $\log_2(94) \approx 6.5545$.
- Multiply by the length of the password: $12 \times 6.5545 \approx 78.65$.
A 12-character random password from this set has approximately 78.6 bits of entropy.
If you restricted the same 12-character password to only lowercase letters and digits ($S = 36$), the entropy would drop significantly:
- $\log_2(36) \approx 5.1699$.
- $12 \times 5.1699 \approx 62.04$.
That same 12-character string now has only 62 bits of entropy. The difference of 16 bits means the first password has $2^{16}$ (65,536) times more possible combinations than the second.
Calculating Entropy for Diceware Passphrases
Now compare that to a Diceware passphrase. Diceware uses a list of words to generate passphrases. A standard Diceware wordlist contains 7,776 words.
Let’s calculate the entropy for a 4-word passphrase using this list.
- Determine the wordlist size: $D = 7,776$.
- Calculate the log base 2 of the wordlist size: $\log_2(7,776) \approx 12.925$.
- Multiply by the number of words: $4 \times 12.925 \approx 51.7$.
A 4-word Diceware passphrase has approximately 51.7 bits of entropy.
This is the counter-intuitive result that confuses many users. The 12-character random password (78.6 bits) is mathematically much stronger than the 4-word passphrase (51.7 bits), even though the passphrase is easier to type and remember. To match the 78.6 bits of the random password using the 7,776-word list, you would need about 6.1 words. Since you can’t have a fraction of a word, you would need 6 words to get $6 \times 12.925 = 77.55$ bits, or 7 words to exceed it comfortably.
| Method | Parameters | Calculation | Entropy (Bits) |
|---|---|---|---|
| Random Password | 12 chars, 94-char set | $12 \times \log_2(94)$ | ~78.6 |
| Diceware Passphrase | 4 words, 7,776-word list | $4 \times \log_2(7,776)$ | ~51.7 |
| Diceware Passphrase | 6 words, 7,776-word list | $6 \times \log_2(7,776)$ | ~77.6 |
Why Marketing Numbers Often Lie
Many password strength meters display a "score" or a percentage that does not correspond to entropy. These meters often guess at the "strength" by checking for complexity rules (e.g., "has one capital," "has one symbol") rather than calculating the actual search space.
A common error is assuming that because a password "looks" complex, it has high entropy. If you manually create a password like P@ssw0rd1!, it contains uppercase, lowercase, symbols, and numbers. A basic meter might rate it "Strong." However, if an attacker knows you follow this common pattern (capital first, leetspeak substitutions, trailing symbol), the effective entropy is far lower than a random 10-character string from the same set. The attacker isn't searching the whole 94-character set; they are searching a much smaller set of known patterns.
True entropy assumes the password was chosen uniformly at random from the stated set. If you choose the password yourself, you are introducing bias. You are likely avoiding certain characters or patterns. This reduces the actual entropy below the theoretical maximum. Random generation is the only way to guarantee the entropy matches the calculation.
Verifying Entropy with PasswordForge
Manual calculation is useful for understanding, but you should verify your generated credentials to ensure they meet your security requirements. PasswordForge displays the real entropy in bits for every generated password and passphrase. This allows you to see immediately if a 4-word passphrase is sufficient for your needs or if you need to add another word.
The tool uses crypto.getRandomValues() for generation, ensuring the randomness is cryptographically secure, and calculates the entropy client-side using the formulas above. You can generate random characters or Diceware passphrases and see the exact bit count next to the output. This removes the guesswork from "is this strong enough?" You simply look for the bit count that matches your threat model. For most online accounts, 60–80 bits is a common target. For offline-protected data where attackers can try billions of guesses per second, you may want 100+ bits.
Common Entropy Mistakes to Avoid
The most frequent mistake is assuming that character variety equals entropy. Using all four character classes (upper, lower, digit, symbol) does not automatically mean you have high entropy if the length is short. A 4-character password from the full 94-character set has only $4 \times 6.55 = 26.2$ bits. That is crackable in seconds on modern hardware. Length is a more powerful multiplier than variety.
Another mistake is using a non-standard wordlist for passphrases. If you use your own vocabulary or a smaller list of common words, the entropy drops. If your personal wordlist has only 1,000 words, each word only contributes $\log_2(1,000) \approx 10$ bits. A 4-word passphrase would then have only 40 bits of entropy. Stick to large, standardized wordlists like the EFF’s 7,776-word list to ensure the math holds up.
Finally, do not confuse "bits of entropy" with "bits of security." If your password is stored as a salted hash with a slow algorithm like Argon2, the effective security against an offline attack is higher than the raw entropy because each guess is expensive. However, if the password is reused or stored poorly, you only have the raw entropy to protect you. Calculate entropy based on the worst-case scenario: an attacker who has the hash and can try guesses quickly.