What is password bit entropy?

Password bit entropy is a mathematical measure of unpredictability and brute-force resistance, calculated as E = L * log2(R), where L is the character length and R is the size of the character pool. A password with 80+ bits of entropy is considered cryptographically secure against offline brute-force attacks.

Password & Secret Entropy Calculator (Brute Force Estimator)

Character Pool (R)

—

Password Length (L)

—

Brute-Force Estimate (100B H/s)

—

The Information Entropy Formula & NIST Standards

Entropy in cryptography describes the number of binary attempts an attacker must theoretically attempt to guess a secret:

E = L × log₂(R)

Where:

L = Character length of the passphrase.
R = Size of the character pool:
- Numbers only (0-9): Pool size = 10
- Lowercase letters (a-z): Pool size = 26
- Mixed case (a-z, A-Z): Pool size = 52
- Alphanumeric + symbols: Pool size = 95

NIST Special Publication 800-63B Recommendations

NIST recommends prioritizing length over character complexity. A 4-word diceware passphrase (e.g. correct horse battery staple) produces over 77 bits of entropy and is significantly easier for humans to remember while remaining mathematically infeasible for brute-force cracking.