Entropy (passwords)

Entropy measures how unpredictable a password is, expressed in bits. Each additional bit doubles the number of guesses an attacker needs. For a randomly generated password, it follows a simple formula: entropy = length × log2 of the alphabet size, so both the length and the variety of characters raise the score.

A random 16-character password drawn from the 94 printable ASCII symbols reaches 16 × log2(94), about 105 bits. At 10 billion guesses per second, exhausting that space would take on the order of 10^14 years, while a 6-character password from the same alphabet peaks at 39 bits and falls in about a minute.

Written as a formula, E = L × log2(N): the entropy equals the length L multiplied by the base-2 logarithm of N, the number of possible symbols per character. Current guidance treats 75 to 80 bits as the comfortable minimum for accounts that matter, a level a random 12-character password mixing all character types already clears.