Password strength is usually presented as a colour: a red bar that turns amber when you add a number and green when you add an exclamation mark. That meter is measuring whether you followed the rules, not whether the password is hard to guess. Those are different questions, and the second one has an actual answer.
Entropy in one paragraph
Entropy measures how many guesses an attacker would need. It is expressed in bits, where each additional bit doubles the work. A password with 40 bits of entropy takes about a trillion guesses to exhaust; one with 41 bits takes two trillion.
The calculation for a randomly generated password is straightforward: multiply the length by the base-2 logarithm of the character set size.
| Character set | Size | Bits per character |
|---|---|---|
| Lowercase only | 26 | 4.70 |
| Lower + uppercase | 52 | 5.70 |
| Lower + upper + digits | 62 | 5.95 |
| All printable ASCII | 95 | 6.55 |
So a 12-character password drawn randomly from letters and digits carries about 71 bits. A 16-character one from the same set carries 95.
The tool Password Generator Open it →The word "randomly" is doing all the work
That formula only holds if every character was chosen independently and unpredictably. It does not describe a password a person invented, because people are not random and attackers know exactly how they are not random.
Take P@ssw0rd!. Nine characters from the full ASCII set would be 59 bits if it were random. It is not. It is one dictionary word with four substitutions that appear on every substitution list ever compiled, plus a trailing exclamation mark, which is the most common trailing character in leaked password sets. A cracking tool with a standard rule set reaches it in the first few million guesses — under a second. Its real entropy is closer to 20 bits than 59.
The same applies to the patterns complexity rules produce. Capitalise the first letter, put the digits at the end, finish with punctuation: Summer2026! satisfies most corporate policies and appears in breach corpora thousands of times over.
How long cracking actually takes
Cracking speed depends enormously on how the password was stored. If a service hashed passwords with a fast algorithm like unsalted SHA-256 — which no service should, but many did — a single modern GPU rig manages on the order of hundreds of billions of guesses per second. If the service used a deliberately slow algorithm such as bcrypt or Argon2 with sensible parameters, the same hardware manages tens of thousands per second. That is a difference of roughly seven orders of magnitude.
The table below assumes the pessimistic case: an offline attack against a fast hash at 1012 guesses per second. Treat these as a worst-case floor rather than a prediction.
| Password | Entropy | Time at 1012 guesses/sec |
|---|---|---|
| 8 chars, lowercase | 37.6 bits | Under a second |
| 8 chars, full ASCII | 52.4 bits | About an hour |
| 12 chars, letters + digits | 71.5 bits | Roughly a century |
| 16 chars, full ASCII | 104.9 bits | Longer than the universe has existed |
| 6-word passphrase | 77.5 bits | Tens of thousands of years |
The useful threshold sits around 75 bits. Below that you are relying on the service having stored your password properly. Above it, the password stops being the weak point regardless of how it was stored.
These figures describe offline attacks, where someone has stolen a database of hashes and can guess at full speed. Online attacks against a login form are limited by rate limiting and lockouts to a handful of attempts per minute, which even a mediocre password survives.
Passphrases
A passphrase built from randomly chosen words is the one approach that produces both high entropy and something a human can memorise. The method matters: the words must be selected randomly from a known list, not composed into a sentence you thought of.
With a 7,776-word list, each word contributes log₂(7776) = 12.9 bits. Six words gives 77.5 bits — comfortably past the threshold, and far easier to type on a phone than sixteen random symbols. Four words gives only 51.7 bits, which is thinner than it feels.
Note the arithmetic assumes the attacker knows your method and your word list. That assumption is deliberate: security that depends on the attacker not knowing your system is not security.
Where entropy stops being the point
A perfect password protects one account. Three things matter more than pushing from 90 bits to 110.
- Reuse is the real vulnerability. When one service is breached, attackers try the same email and password everywhere else. This is called credential stuffing and it is the most common way ordinary accounts are compromised — not cracking, just reuse. A unique password per site matters more than the strength of any one of them.
- Two-factor authentication defeats the whole category. A stolen password alone becomes useless. An authenticator app or hardware key is meaningfully stronger than SMS, which is vulnerable to SIM swapping.
- Phishing ignores entropy entirely. If you type a 100-bit password into a convincing fake login page, its strength is irrelevant. Password managers help here in a way people underrate: they refuse to autofill on a domain that does not match, which catches the fake before you do.
Practical advice
- Use a password manager and let it generate 16 or more random characters for everything you do not have to type by hand.
- For the handful you must memorise — your device login, your manager's master password — use a six-word random passphrase.
- Turn on two-factor authentication on email first. Email is the master key: whoever controls it can reset everything else.
- Stop changing passwords on a schedule. Forced rotation produces predictable increments like
Summer2026!becomingAutumn2026!. Change a password when there is reason to think it was exposed.
Modern guidance from NIST reflects this: length beats imposed complexity, and mandatory periodic rotation is no longer recommended in the absence of evidence of compromise.