The only number in password strength that means anything
Everything else in password strength is decoration. A coloured bar, a label reading "strong", a tick for having included a number. These are opinions. Entropy is a count, and it can be checked by anyone who disagrees with it.
In information theory, entropy measures how much uncertainty a value contains. For passwords it means: given that you know the rules your generator followed, how many possible passwords could this one be? The answer is a number of bits, because each bit represents one binary decision, and each additional bit doubles the work required to guess the value.
How to calculate it, and what each choice is worth
The formula is length multiplied by the base-two logarithm of the alphabet size. If you are using all 26 lowercase letters, each character carries 4.7 bits. Add uppercase and the alphabet grows to 52 characters, giving 5.7 bits each. Add ten digits and it becomes 62, at 6.0 bits. Add thirty-odd symbols and you reach 94 characters, at 6.6 bits.
- 26 lowercase letters gives 4.7 bits per character.
- 26 uppercase gives 5.7 bits per character.
- 10 digits gives 3.3 bits on their own, or 6.0 bits once combined with letters.
- Around 30 symbols gives 6.6 bits per character, the most of any class.
- 100 characters gives 6.6 bits. 1,000 gives almost 10. 1 million gives 20.
Those per-character values are the whole argument. Going from lowercase to a full symbol set is worth about 1.9 bits per character. Adding four characters of any kind is worth about 19 bits. So fourteen extra lowercase characters are worth more than seven times the improvement from adding every symbol you have, and take less time to type.
Why the obvious examples do not work
The weakness of this calculation is that it assumes every character is independent of the last. In practice that holds for generated passwords and fails for chosen ones, and the failure is often large.
A password reading Tr0ub4dor&3 is the standard example. Eleven characters across four character classes looks impressive, and the formula gives it about 72 bits. But it contains two repeated characters, and its shape follows a deliberate pattern of consonant, vowel, consonant. Real entropy is closer to 45. A twenty-five character lowercase passphrase built from four words in a large list has no such structure, and carries well over 100 bits. It also reads as English, which sounds like a weakness and is not: guessing it requires trying combinations drawn from thousands of words, not from the dictionary of the language you are typing in.
The Ufumbuzi password generator calculates and displays this figure for every password it produces, using the standard formula from NIST SP 800-63-4, and measures the alphabet the password actually contains rather than the classes you ticked. It will also tell you, honestly, when a password you typed in by hand scores lower than you would expect.
Useful recommendations
Ufumbuzi runs on one of these. We are not paid to list the rest.
If you ever want to build something of your own, this is where we host Ufumbuzi. Hostinger offers shared hosting, domains and email at prices lower than most providers, and there is a discount waiting on the link.
Disclosure: Some links on this page are referral links. If you make a purchase through them, we may earn a small commission at no extra cost to you, while you get a special discount. We only recommend services that add real value.