What Entropy Measures
Entropy in bits quantifies the uncertainty of a password by counting how many bits of information it carries. This is not a measure of length or complexity — it is a measure of how many possible passwords could have been generated with the same rules. A 40-bit password has about one trillion possibilities; a 60-bit password has about a quintillion; a 128-bit password has about 340 undecillion.
The calculation depends on two factors: the number of possible characters in the password alphabet, and the length of the password. If a password uses only lowercase letters, the alphabet size is 26. If it uses lowercase, uppercase, digits, and common symbols, the alphabet size is typically 94. The entropy in bits is the logarithm base 2 of the total number of possible passwords, which works out to length times the logarithm base 2 of the alphabet size.
40 Bits: The Minimum for Online Attacks
A 40-bit password has roughly one trillion possible values. This is the practical floor for passwords that will be verified online, where attackers can submit guesses over a network connection. At one billion guesses per second, a 40-bit password would be exhausted in about 20 minutes. At one million guesses per second, it would take about 35 years.
The problem with 40 bits is that it is only adequate when the password is generated randomly and the attacker cannot exploit patterns in how humans create passwords. A 40-bit password that is memorized by a human — something like correcthorsebatterystaple — may have more effective entropy than a 40-bit password that is chosen from a dictionary, because the dictionary attack reduces the search space. The entropy calculation assumes uniform randomness; real passwords rarely achieve this.
For online services that enforce rate limiting and do not expose the password to brute force, 40 bits is sufficient. For services that allow unlimited guesses or where the password hash is stolen and cracked offline, 40 bits becomes marginal.
60 Bits: The Practical Target
A 60-bit password has about a quintillion possible values. This is the widely recommended target for most use cases. At one billion guesses per second, a 60-bit password would take about 30,000 years to exhaust. At one million guesses per second, about 30 million years.
60 bits is achievable with a 12-character password using a 94-character alphabet, or with an 8-character password using a 16-character alphabet. The key insight is that length and alphabet size trade off against each other. A longer password with a smaller alphabet can have the same entropy as a shorter password with a larger alphabet.
Most password managers generate passwords with 60 or more bits of entropy by default. This is because 60 bits provides a comfortable margin above the minimum for online attacks while remaining practical for human memorization when the password is generated as a passphrase rather than a random string.
128 Bits: The Theoretical Maximum
A 128-bit password has about 340 undecillion possible values. This is the entropy of a password generated from 128 random bits — the same as a typical AES-256 key, though AES-256 uses 256 bits. 128 bits is the practical maximum for a password that can be typed by a human, because a password longer than about 64 characters becomes difficult to enter reliably on most keyboards.
At one billion guesses per second, a 128-bit password would take about 1021 years to exhaust. This is far longer than the age of the universe, so a 128-bit password is effectively unbreakable by brute force. The constraint on 128-bit passwords is not computational — it is usability. A randomly generated 128-bit password is typically a string of 40 to 50 characters with no obvious pattern, which is difficult to memorize and easy to mistype.
For most practical purposes, 60 bits is sufficient. 128 bits is useful when the password is stored in a password manager and the manager does the typing. It is also useful when the password is used as a key for encryption, where the full entropy matters.
How Entropy Relates to Real-World Attacks
The entropy calculation tells you the theoretical strength of a password. It does not tell you how strong the password is against a real attacker. Several factors reduce the effective entropy below the theoretical value.
First, if the password is generated from a dictionary or a set of common words, the entropy is lower than the calculation suggests, because the attacker can exploit the non-uniform distribution of words. A 12-word passphrase from a 2048-word wordlist has about 132 bits of entropy, but a 12-word passphrase chosen from a smaller set of common words may have only 60 bits.
Second, if the password is stored as a hash, the attacker can precompute hashes for common passwords and reduce the effective entropy. A password with 60 bits of entropy may have only 40 bits of effective entropy if the attacker has a precomputed table of the most common passwords.
Third, if the password is entered through a keyboard, the attacker can exploit the fact that humans tend to press keys that are close together on the keyboard. This reduces the effective alphabet size and thus the effective entropy.
Choosing Between Length and Alphabet Size
When generating a password, you can choose between a longer password with a smaller alphabet and a shorter password with a larger alphabet. The entropy is the same, but the usability differs.
A 12-character password using lowercase letters has about 59 bits of entropy. A 10-character password using lowercase, uppercase, digits, and symbols has about 66 bits of entropy. The 10-character password has higher entropy, but the 12-character password may be easier to type and remember because it uses a smaller alphabet.
The choice depends on the use case. For a password that is memorized, a longer password with a smaller alphabet is often preferable. For a password that is stored in a password manager and entered programmatically, a shorter password with a larger alphabet is often preferable.
Tool mentioned: PasswordForge