Password strength explained: entropy, bits and crack times
The short version. Password strength is measured in bits of entropy. Each bit doubles the work an attacker has to do. A truly random 16 character password from the full keyboard is worth about 105 bits, which is out of reach of any attacker alive. A password you invented yourself is worth far less than its length suggests, because cracking software models human habits. Length beats complexity, randomness beats both.
What "strength" actually measures
People talk about a password being strong the way they talk about a lock being sturdy, but the analogy is misleading. A password has no physical resistance. Its only defence is that an attacker has to try candidates until one works, and strength is simply a count of how many candidates they must try.
That count is expressed in bits, because the numbers get unwieldy fast. One bit means two possibilities. Ten bits means 1024. Fifty bits means about a thousand trillion. When you read that a password is worth 60 bits, it means an attacker who knows exactly how it was made, but not which one it is, faces around 260 candidates and will find it after about half of them on average.
The phrase "who knows exactly how it was made" is the part everyone skips, and it is the part that matters. Entropy is not a property of the string of characters. It is a property of the process that produced it. The password 7cQ!vT2mLx9pRw4z and the password Password12345678 are both 16 characters. One came out of a random generator and is worth 105 bits. The other is on every cracking list in existence and is worth about zero. Nothing you can measure by looking at the characters alone distinguishes them reliably.
How entropy is calculated for a random password
When each character is drawn independently and uniformly from a pool, the arithmetic is simple:
entropy in bits = length × log2(size of the character pool)
| Character pool | Size | Bits per character | 16 characters |
|---|---|---|---|
| Digits only | 10 | 3.32 | 53 bits |
| Lowercase letters | 26 | 4.70 | 75 bits |
| Letters, both cases | 52 | 5.70 | 91 bits |
| Letters and digits | 62 | 5.95 | 95 bits |
| Full printable keyboard | 95 | 6.57 | 105 bits |
Notice how little the pool matters compared to the length. Moving from lowercase only to the full keyboard adds 1.87 bits per character. Adding four more characters to a lowercase password adds 18.8 bits. If a site forces you to choose between symbols and length, take the length every time.
Turning bits into time
Bits become a number of years once you fix a guessing rate, and the guessing rate depends almost entirely on how the target stored your password, not on how good your password is.
| Situation | Realistic guessing rate | Why |
|---|---|---|
| Online login form with rate limiting | 10 to 100 per second | Every attempt is a network round trip, and lockouts kick in |
| Leaked database, unsalted MD5 or SHA-1 | 1011 to 1012 per second | Fast hashes, massively parallel on GPUs |
| Leaked database, bcrypt at cost 12 | about 200 thousand per second | Deliberately slow and memory hungry by design |
| Leaked database, Argon2id tuned properly | tens of thousands per second | Memory hard, resists GPU parallelism |
The spread is seven orders of magnitude. A 12 character random password from the full keyboard survives 43 billion years against bcrypt and about 9 thousand years against unsalted MD5. Both are fine. The same password reduced to 8 characters survives 55 minutes against MD5. You have no way of knowing which hash a given site uses, and you will find out only when it is breached, so the only sane policy is to assume the worst.
A caveat about published crack time tables. Every table on the internet, including the one on our home page, assumes the attacker brute forces the entire keyspace. Real attackers never do that. They run dictionaries, leaked password lists, mangling rules and Markov models first, and only fall back to brute force for what is left. Against a genuinely random password those shortcuts are useless and the table holds. Against a password a human invented, the table is fiction: the real answer is usually seconds.
Why your own passwords are weaker than they look
Cracking tools do not guess uniformly. Hashcat rules, PRINCE and neural models exploit the fact that human choices cluster tightly. A few of the patterns they encode:
- Capital letters go at the start, digits and punctuation at the end.
Sunflower2019!is 14 characters and falls in minutes. - Letter to symbol substitution is exhaustively modelled.
P@ssw0rdis not a variation, it is a dictionary entry. - Years cluster in the last thirty. Appending 1987 adds about five bits, not thirteen.
- Keyboard walks such as qwerty, 1qaz2wsx and zxcvbnm are enumerated first.
- Anything drawn from your public life is tried early: employer, city, sports team, children's names, pet names, band names.
- Reuse with a site suffix, such as
MyPasswordFBandMyPasswordGM, is the first rule applied to any credential leak.
Studies of large credential dumps repeatedly put the median human chosen password somewhere around 20 to 22 bits of real entropy, whatever its length. That is the gap the generator closes. Not by making the password longer, but by removing you from the decision.
How much entropy do you actually need?
| Entropy | Verdict | Reasonable use |
|---|---|---|
| Under 40 bits | Weak | Nothing that matters. Falls to an offline attack in minutes. |
| 40 to 60 bits | Fair | A throwaway forum account behind rate limiting, at a push. |
| 60 to 80 bits | Strong | A solid master passphrase. Beyond offline brute force for a slow hash. |
| 80 to 128 bits | Very strong | The comfortable range for anything a manager stores for you. |
| Above 128 bits | Excessive | No added safety. Nothing gets broken here by guessing. |
Above roughly 128 bits the discussion stops being about passwords. Nobody is going to guess a 128 bit secret, so anyone who wants your account will phish you, plant malware on your machine, intercept a password reset email or ask the support desk nicely. Extra length past that point is free but it buys nothing.
Practical targets
- Any account stored in a password manager: 16 characters from the full keyboard, unique per site. About 103 bits with our symbol set, generated in one click on our generator.
- Email, banking, domain registrar, cloud console: 20 to 24 characters, plus two factor authentication. These accounts can reset the others, so they deserve the extra margin.
- Anything you have to type from memory: a six or seven word passphrase, 66 to 77 bits. See passphrases vs random passwords.
- Sites that reject symbols or cap the length: use whatever they allow, at the maximum length they allow, and never reuse it anywhere.
Things that raise strength more than extra characters do
Once a password is past 80 bits, the return on more characters is zero and the return on everything else is large:
- Uniqueness. A 105 bit password reused on twelve sites is only as strong as the weakest of those twelve. This is the mistake that causes most real account takeovers.
- Two factor authentication. A stolen password alone stops being enough. Prefer an authenticator app or a hardware security key over SMS codes, which can be intercepted through SIM swapping.
- Breach monitoring. Knowing that a site you use was breached lets you rotate one password deliberately instead of rotating all of them on a calendar.
- Phishing resistance. A password manager that only fills credentials on the exact domain it saved them for will refuse to fill on a lookalike domain, which catches an attack that no amount of entropy would have stopped.