Password Entropy: How to Measure It

Updated 14 November 2026 · Standard formula, shown below

This guide shows you how to measure the entropy of a password—a number that tells you how hard it is to guess. You’ll learn to calculate it by hand or with a simple formula, and how to interpret the result. No special tools are needed, just a basic understanding of math and your password’s structure.

What You’ll Need

A password you want to evaluate (or a candidate you’re considering).
A calculator (optional, but helpful for the math).
Knowledge of the character set used (e.g., lowercase letters, numbers, symbols).
Basic familiarity with logarithms (or use the online calculator on this page).

Step-by-Step

Identify the character set size (N). Count the number of possible characters for each position. Common sets: lowercase (26), uppercase (26), digits (10), symbols (33 on a standard keyboard). If your password uses only lowercase letters, N=26. If it uses lowercase and digits, N=36. If it uses all four types, N=95.
Determine the password length (L). Count the total number of characters in the password. For example, “Tr0ub4dor&3” has 11 characters.
Calculate entropy in bits. Use the formula: Entropy = L × log2(N). If you don’t have a log base 2 calculator, use the change of base: log2(N) = log(N) / log(2). For N=95, log2(95) ≈ 6.57 bits per character.
Multiply length by bits per character. For a password of length 11 with N=95, entropy = 11 × 6.57 ≈ 72.3 bits. That’s a strong password.
For passphrases (multiple words), treat each word as a character. If you have a passphrase like “correct horse battery staple”, N is the size of your word list (e.g., 7776 for Diceware), and L is the number of words (4). Entropy = 4 × log2(7776) ≈ 4 × 12.9 ≈ 51.6 bits.
Interpret the result. Generally, entropy below 30 bits is weak, 30-50 bits is moderate, 50-70 bits is strong, and above 70 bits is very strong. For online accounts, aim for at least 60 bits; for encryption keys, 80+ bits is recommended.

Common Mistakes

Assuming all characters are equally likely. If you use a pattern like “password123”, the actual entropy is lower because a hacker can guess common patterns. The formula assumes random selection.
Using the wrong character set size. If you think you have 95 characters but your password only uses lowercase and digits, N=36, not 95. Always count what you actually used.
Forgetting that passphrases use word list size, not letter count. A passphrase of 4 words from a 7776-word list has 51.6 bits, not 4 × 26 = 104 bits.
Rounding too early. If you round log2(95) to 6.5 instead of 6.57, you’ll overestimate entropy for long passwords. Keep at least two decimal places.
Confusing entropy with password strength. Entropy is a measure of unpredictability, but a password like “Tr0ub4dor&3” might still be weak if it’s a known phrase with substitutions. Always use a password manager to generate random passwords.

Tips

Use a password manager. It can generate and store high-entropy passwords for you, so you don’t have to remember them.
Prefer length over complexity. A 16-character lowercase password has 16 × 4.7 = 75.2 bits, which is stronger than an 8-character mixed password (8 × 6.57 = 52.6 bits).
Use passphrases for memorable security. Four random words from a large dictionary give you high entropy and are easier to type.
Check your password against breach lists. Even high entropy doesn’t help if your password has been leaked. Use a service like Have I Been Pwned to check.
Enable two-factor authentication. Entropy protects against offline guessing, but 2FA adds a second layer for online attacks.

Troubleshooting

My calculation seems too high. Double-check your character set size. If you used a pattern or a known phrase, the effective entropy is lower. Use a random password generator instead.
I don’t know how to calculate log2. Use the change of base formula: log2(N) = log(N) / log(2). Most calculators have a log button. Or use the online calculator on this page.
My passphrase entropy seems low. If you’re using common words, an attacker might try a dictionary attack. Use a larger word list or add a random separator.
I get different results from different tools. Some tools estimate entropy by analyzing patterns (like keyboard walks) and give a lower number. That’s fine—it’s a more conservative estimate. For a pure mathematical measure, use the formula above.
I have a password with repeated characters. The formula still applies as long as each character is chosen independently. But if you’re choosing a pattern, the entropy is lower.

Frequently Asked Questions

What is a good entropy score for a password?

For most online accounts, aim for at least 60 bits. For sensitive data like encryption keys, 80 bits or more is recommended. Below 30 bits is considered weak.

How is entropy different from password strength?

Entropy is a mathematical measure of unpredictability. Password strength is a broader concept that also considers resistance to common attacks like dictionary or pattern matching. A high-entropy password can still be weak if it’s a known phrase with substitutions.

Can I calculate entropy for a password I already use?

Yes, but you need to know the character set and length. If the password was randomly generated, the formula is accurate. If it’s a pattern, the actual entropy is lower.

Does entropy change if I use a password manager?

No, entropy is a property of the password itself. A password manager can generate high-entropy passwords, but the entropy of a given password is fixed.

What is the entropy of a 8-character password with uppercase, lowercase, and digits?

N=62 (26+26+10). log2(62) ≈ 5.95. Entropy = 8 × 5.95 = 47.6 bits. That’s moderate, but not great for critical accounts.

Is a longer password always better?

Generally yes, because entropy scales linearly with length. But a long password that is a common phrase has low entropy. Randomness is key.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.