Password Entropy Visualizer

Entropy measures the search space, not the password

Entropy in bits is the base-two logarithm of the number of possible passwords the generation process could have produced. Each additional bit doubles that space. It is a property of how the password was created, not of the string itself: a randomly generated password and one a human chose can look identical and have wildly different entropy, because the human's choice came from a far smaller effective set.

The arithmetic

For a truly random password, entropy is length multiplied by the base-two log of the alphabet size. Lowercase alone gives about 4.7 bits per character, adding uppercase and digits gives about 5.95, and full printable ASCII gives about 6.55. So a random 12-character password from the full set carries roughly 79 bits. Note how weakly the alphabet contributes compared with length: adding four characters beats adding symbols, every time.

Why human-chosen passwords score far lower

The formula assumes uniform randomness. "P@ssw0rd123!" appears to draw on all four character classes at twelve characters, but every substitution in it is one an attacker's rules already generate. Its real entropy is closer to 20 bits than 79. Cracking tools do not brute-force blindly; they run dictionaries, leaked-password lists and mangling rules first, which is precisely the space human choices occupy.

What the bit counts mean in practice

Under 40 bits falls to a modern GPU rig quickly. Around 60 bits resists casual attack but not a determined one against a fast hash. Around 80 bits is comfortable for most purposes. Above 100 bits is beyond brute force with any foreseeable technology. These thresholds shift with the hash: a password stored under bcrypt with a high work factor survives far longer than the same password under an unsalted SHA-1, and that choice is the defender's, not the user's.

Passphrases win on entropy per unit of effort

Four words drawn randomly from a 7,776-word list carry about 51.7 bits and are far easier to remember than eight random characters carrying 52. Six words reach 77.5 bits. The critical word is randomly: words you chose yourself carry a fraction of that, because a self-selected phrase is drawn from the small set of phrases a person would think of.

Entropy is not the whole threat model

A 100-bit password offers nothing against phishing, a keylogger, credential reuse after a breach, or a server storing passwords in plaintext. Entropy addresses guessing alone. Unique passwords per site, a manager to make that practical, and multi-factor authentication address the attacks that actually succeed.