What Makes a Password Strong? Understanding Entropy

Entropy measures the unpredictability of a password in bits. A password with n bits of entropy has 2^n possible combinations. For example, a password with 40 bits of entropy has about 1 trillion possible values. Each additional bit doubles the number of possibilities, making the password exponentially harder to crack.

The formula for entropy is: E = L × log2(R), where L is the password length and R is the size of the character pool. A 12-character password using lowercase letters only (pool size 26) has about 56 bits of entropy. The same length using uppercase, lowercase, digits, and symbols (pool size ~80) has about 76 bits — a thousand times harder to crack.

Entropy is the single best metric for comparing password strength. It accounts for both length and character variety, giving you a number that directly correlates with resistance to brute-force attacks.

Length is the most important factor. Each additional character multiplies the total number of possible passwords. Going from 8 to 12 characters with the same character set increases entropy by 50%. Going from 12 to 16 characters doubles it again.

Character variety matters too. Using only lowercase letters gives a pool of 26. Adding uppercase doubles it to 52. Adding digits brings it to 62. Adding symbols pushes it to 80+. Each expansion increases the log2(R) component of the entropy formula.

Randomness is critical. Human-created passwords have far less entropy than their length suggests because people use predictable patterns: dictionary words, keyboard rows, common substitutions, and personal information. A password like 'Tr0ub4dor&3' looks complex but has only about 28 bits of entropy because it follows predictable patterns that cracking tools exploit.

Cracking time depends on the attacker's hardware and the password's entropy. A modern GPU can test about 10 billion passwords per second. With a cluster of GPUs or cloud resources, attackers can test trillions per second. At 1 trillion guesses/second, a 40-bit entropy password is cracked in under 2 minutes, while a 64-bit password takes about 584 years, and an 80-bit password takes longer than the age of the universe.

Common weak patterns to avoid: dictionary words (even with substitutions), keyboard patterns (qwerty, asdfgh), repeated characters (111111), sequential patterns (123456, abcdef), personal information (names, birthdays), and common base words with simple suffixes (password1, admin123).

The solution is simple: use a password generator to create random passwords with 16+ characters from a full character set. Store them in a password manager so you never need to remember them. This approach gives you 80+ bits of entropy for every account, making brute-force attacks completely impractical.