Password Entropy

In one sentence: Password entropy is a score in bits that counts how many passwords a random generator could have made, so a higher score means guessing one is harder.

$H = L \log_2 N$

Read it out loud: “H, the password entropy, equals L times the base-2 logarithm of N. L is the length of the password, in characters. N is the number of symbols each character is chosen from. The base-2 logarithm of N is the power you raise 2 to in order to get N. H is measured in bits.”

Before you start

The ideas and signs this page uses, explained from zero. For powers of ten, Greek letters and other notation in general, see Math basics.

Bit: one choice between two: A bit is one binary choice, a 0 or a 1. Each bit doubles the number of possibilities. One bit gives 2 options, 2 bits give 4 options and 3 bits give 8 options. Security measures a secret in bits, because the number of bits tells you how many possible values there are.
Base-2 logarithm, $\log_2$: The base-2 logarithm of a number is the power you raise 2 to in order to get that number. So $\log_2 8 = 3$ , because $2^{3} = 8$ . The value $\log_2 N$ tells you how many bits it takes to label each of $N$ choices. For $N = 62$ the value is about 5.95, because $2^{5.95}$ is about 62.
Natural log, $\ln$: The natural log, written $\ln$ , is the logarithm with the base $e$ , which is about 2.718. Calculators and textbooks in other fields often use it. It measures the same thing in a different unit, called nats, so $\ln 62$ is about 4.13 while $\log_2 62$ is about 5.95. The formula needs $\log_2$ , which gives bits.
Powers of ten, like $10^{14}$: A power of ten is 10 multiplied by itself a set number of times. $10^{14}$ means 1 followed by 14 zeros, which is 100 trillion. The number $2.18 \times 10^{14}$ means 2.18 with the decimal point moved 14 places to the right, so it is 218 trillion. A negative exponent means divide, so $10^{-3} = 0.001$ .
Random choice and equal chances: A password is random when every symbol in it has the same chance of being picked, like the faces of a fair die. A person choosing a password does not usually pick at random. Names and dates follow patterns, so the entropy formula describes only passwords made by a random process, such as a generator.
Symbol set: The symbol set is the list of characters a password may use. Lowercase letters, uppercase letters and digits together make 62 symbols. Adding punctuation marks makes the set bigger, and a bigger set gives more choices for each character, so each character adds more bits.
Entropy: Entropy, in this page, is a measure of how many equally likely outcomes a random process has, counted in bits. More possible outcomes means more uncertainty about the result, so a guesser needs more tries. The word has related meanings in physics, but this page uses it only in this sense.

What each symbol means

Symbol	Meaning
$H$	The password entropy, measured in bits. Each extra bit doubles the number of possible passwords. A value of 47.6 bits corresponds to about 218 trillion possibilities, which is about $2.2 \times 10^{14}$ choices.
$L$	The length of the password, a plain count of characters, such as 8 or 12. Every character is chosen at random, so every extra character adds the same number of bits. It has no unit, because it counts characters.
$N$	The number of symbols each character is picked from, a plain count such as 62. It has no unit. A larger symbol set gives more choices for each character, so each character adds more bits to the password.
$\log_2$	The base-2 logarithm, the power that 2 must be raised to in order to get the number inside. It converts a count of choices into a count of bits. It has no unit, because it is a pure number.

The formula piece by piece

$N$: The number of choices for one character, such as 62 for lowercase letters, uppercase letters and digits together. It is a count of possible symbols with no unit, and it sets how many possibilities each character adds to the password.
$\log_2 N$: The number of bits needed to pick one character. For 62 symbols it is about 5.95 bits. That is more than 5 bits, which gives 32 options, and less than 6 bits, which gives 64 options, so 62 lies between those two counts.
$L \log_2 N$: The bits for the whole password: the bits for one character added up over all $L$ characters. Every character is chosen independently, so the bits add up, and multiplying by the length is the same as adding the same number $L$ times.
$H = L \log_2 N$: The whole formula in one sentence: the password entropy in bits equals the password length times the base-2 logarithm of the number of symbols each character is chosen from.
$2^{H} = N^{L}$: A standard textbook relation, read in reverse. The number of possible passwords, $N^{L}$ , equals two raised to the power $H$ . This is why each bit of entropy doubles the count of passwords: adding one bit multiplies $2^{H}$ by 2.

What the formula is doing, and why

Entropy here measures how many different passwords could have been produced. A character picked at random from $N$ symbols is one of $N$ equally likely results. A password of $L$ such characters has $N^{L}$ possible values. The base-2 logarithm turns that count into bits, so $\log_2 N^{L} = L \log_2 N$ , which is the formula.

Why multiply by the length? Each character is a separate random choice, and independent choices multiply their counts. Two characters from 62 symbols give $62 \times 62 = 62^{2}$ possibilities. In bits the two characters add: each gives about 5.95 bits, so together they give about 11.9 bits. Every bit doubles the number of possible passwords, so each character adds bits and the total grows with the length.

Why the logarithm? Counting possibilities gives huge numbers, such as $62^{8}$ , which is over 200 trillion. A logarithm shrinks such numbers to a size we can compare, such as 47.6 bits. The formula works in bits so that numbers of very different sizes can be compared directly. A larger symbol set and a longer password both raise the number of bits.

When does the formula apply? The formula holds only when every password is equally likely, which is true when a computer or a set of dice picks each character at random. A password a person invents is not random. People favor words, names, dates and common substitutions such as p@ssw0rd, which guessing tools try first. For a human-chosen password, the real strength is far lower than the formula suggests.

What the number does and does not mean. Entropy describes the method that made the password, not the password itself. A high number means the password came from a process with that many choices. It does not prove that a particular password is safe, because an attacker who knows the method can count the same possibilities.

An everyday picture

Think of a combination lock with several dials, each with 62 positions. Every extra dial multiplies the number of combinations, so the lock gets harder to open. A random password works the same way, with each random character acting as one more dial. A password built from a familiar phrase is like a lock whose combination is written on the case.

Worked example: An 8-character random password, then 12 characters

Imagine a random password generator that picks each character from $N = 62$ symbols: 26 lowercase letters, 26 uppercase letters and 10 digits. We find the entropy for a password of $L = 8$ characters, and then for $L = 12$ .

Count the symbols. Each character can be any of 26 lowercase letters, 26 uppercase letters or 10 digits. Adding these gives $26 + 26 + 10 = 62$ choices for every character. The generator picks at random, so each of the 62 choices is equally likely.
Find the bits for one character. We need $\log_2 62$ , the power that 2 must be raised to in order to reach 62. Since $2^{5} = 32$ and $2^{6} = 64$ , the answer lies between 5 and 6. A calculator gives $\log_2 62 \approx 5.954$ bits per character.
Multiply by the length. For 8 characters, $H = 8 \times 5.954 \approx 47.63$ bits. The bits of the characters add up, so the total is the bits per character times the number of characters.
Read the number as a count of passwords. The count of possible passwords is $62^{8} = \text{218,340,105,584,896}$ . That is $2.18 \times 10^{14}$ , which means 2.18 with the decimal point moved 14 places to the right, about 218 trillion. Each bit doubles the count, so 47.63 bits means about this many possibilities.
Add four more characters. For 12 characters, $H = 12 \times 5.954 \approx 71.45$ bits. The four extra characters add $4 \times 5.954 \approx 23.82$ bits to the 47.63 bits, which gives the same 71.45 bits.
Find the multiplier for those extra characters. Each extra character multiplies the count of passwords by 62, so four more characters multiply it by $62^{4} = \text{14,776,336}$ , about 14.8 million. That is why a few random characters make such a large difference.
Compare with a smaller symbol set. A 12-character password from only the 26 lowercase letters has $H = 12 \log_2 26 \approx 56.4$ bits. That is about 15 bits less than the 71.45 bits from 62 symbols, so the larger set matters.

Answer: An 8-character random password has about 47.6 bits of entropy. Four more random characters raise it to about 71.45 bits, because each extra character multiplies the number of possible passwords by 62.

The numbers in this example are recomputed by script every time the site is built.

Common mistakes

Using the formula for a password a person chose. Names, dates and common words are guessed far sooner than a random string of the same length.
Counting length without the symbol set. A 12-character random password from 26 lowercase letters has $H = 12 \log_2 26 \approx 56.4$ bits, much less than the 71.45 bits of 12 characters from 62 symbols.
Using the natural logarithm, $\ln$ , instead of $\log_2$ . That gives a number in nats rather than bits, and it comes out about 0.69 times the bit value, so the result is wrong.
Assuming a password is strong because it has many symbol types. Predictable substitutions, such as replacing a with @, add little, because attackers try them too.

Where you will meet it

Random password generators, which pick each character with equal chance so that the formula’s assumption holds.
Passphrase generators built on word lists, such as the diceware list of 7776 words.
Security policies that set a minimum password length or require a larger set of character types.
Cryptography, where keys and secrets must come from a random source with enough entropy.

Questions people ask

Is a long password always strong?

Not always. Length helps when the characters are random. A long password built from a familiar phrase or pattern has far fewer real possibilities than the formula suggests.

Why use base 2 for the logarithm?

Computers store information in bits, and each bit doubles the number of possibilities. Base 2 gives the answer directly as a number of bits.

Does this formula tell me how long guessing will take?

Not directly. It counts possibilities. The time to guess depends on how fast an attacker can test each one and on whether the attack tries the most likely candidates first.

Shannon Entropy: Shannon entropy is one number, measured in bits, that says how unpredictable a source of messages is on average: the more predictable it is, the fewer bits its messages need.
Binary Number Value: Binary uses only the digits 0 and 1, and this formula turns a row of those digits into the ordinary number they stand for.
Hamming Distance: Hamming distance counts the spots where two same-length codes differ, such as the bits in two binary words, and that count shows how many errors a code can catch.