What Makes a Password Strong: Length, Randomness and Entropy

Counting the possibilities

If each character is chosen at random from a pool of N symbols and the password has L characters, there are N to the power L possible passwords. Strength is usually quoted in bits of entropy, which is the base-2 logarithm of that count. Each extra bit doubles the number of possibilities.

entropy (bits) = L × log₂(N)Valid only when every character is chosen at random and independently.

Widening the pool helps only modestly: moving from lowercase letters to all 94 printable characters adds 6.55 − 4.70 = 1.85 bits per character. One more character of length adds the full per-character figure from the table, which is between 3.3 and 6.6 bits.

Why length beats complexity

Worked example: a random 8-character password from all 94 printable characters has 94⁸ = 6.1 × 10¹⁵ possibilities, which is 8 × 6.55 = 52.4 bits. A random 12-character password using only lowercase letters has 26¹² = 9.5 × 10¹⁶ possibilities, or 12 × 4.70 = 56.4 bits. The plain lowercase password is stronger, because it is longer.

Going longer pays off quickly. Four more lowercase characters multiply the count by 26⁴ = 456,976. A random 16-character lowercase password reaches 75.2 bits, and 12 random characters from the full 94-symbol pool reach 78.7 bits.

Many sites still insist on symbol and capital rules. If you must follow them, make the password long and random first, and then satisfy the rule, rather than relying on the rule to provide the strength.

Passphrases made of random words

A passphrase treats each word as one symbol. With a list of 7,776 words (the size used for dice-based word lists), each word adds log₂(7,776) = 12.92 bits.

• 4 random words: 4 × 12.92 = 51.7 bits, about the same as a random 8-character password from the full keyboard.
• 5 random words: 64.6 bits.
• 6 random words: 77.5 bits, similar to 12 random characters from 94 symbols, and easier to type and remember.

The words must be chosen by chance, with dice or a generator, and not picked because they feel memorable. A phrase you invented, a song lyric or a famous quotation has far fewer real possibilities than the formula assumes.

What the bits mean in practice

To make the numbers concrete, suppose an attacker could test 10 billion guesses per second. This rate is only an assumption for illustration. Real speeds depend heavily on how a service stores passwords and on the attacker's equipment, and guessing against a live login form is far slower than cracking a stolen file.

On average an attacker finds the password halfway through, so the expected time is half these figures. The pattern is the point: every 10 extra bits makes the search roughly a thousand times longer.

Where the math stops helping

Entropy is a property of how a password was chosen, not how it looks. "P@ssw0rd1!" looks complex, but it is a common word with predictable substitutions and a predictable ending, so it has very little real entropy. Attackers try likely patterns and leaked passwords first.

• Use a different password for every account, because a leak at one site then cannot unlock another.
• Let a generator create the password, since people are poor at choosing randomly. The random password generator creates one to your length and character settings.
• Store passwords in a password manager so that length is not limited by memory, and turn on two-step verification where it is offered.

You can reproduce every figure above with the exponent calculator for N to the power L and the log calculator for base-2 logarithms.

This article is general education about how password strength is measured, not security advice for any specific system. Follow the guidance of the service or organization that holds the account.