What Password Strength Actually Measures

Strength is a number, and each bit doubles it

Entropy in bits answers one question: how many guesses would an attacker need to work through every possibility? A password with 40 bits of entropy has 2⁴⁰ possibilities, about 1.1 trillion. One with 41 bits has twice that. One with 60 bits has a million times more than 40.

That doubling is why bits are the useful unit rather than "number of possible passwords" — the raw counts get unreadable fast, but the difference between 52 bits and 78 bits is easy to hold in your head once you know each step doubles.

The formula is length × log₂(alphabet size). Lowercase only is 26 characters, so 4.7 bits per character. All 95 printable ASCII characters is 6.57 bits per character. A character is not worth much on its own, which is the entire reason short passwords fail no matter what you put in them.

Length beats complexity, and here is the arithmetic

Take a 12-character lowercase password: 12 × 4.70 = 56.4 bits. Now switch on uppercase, digits and every symbol, which is the thing every password policy demands. That takes each character from 4.70 bits to 6.57, and the total to 78.8 bits — a gain of 22.4 bits.

Now instead leave it in lowercase and make it longer. Each extra letter adds 4.70 bits, so the same 22.4-bit gain arrives after 4.8 more letters. Five more lowercase characters buys exactly what every symbol on the keyboard buys.

And one of those two is far easier to type on a phone, far easier to remember, and far less likely to end up written on a sticky note. That is the whole case for length, and it is arithmetic rather than opinion.

The same password, against three different attackers

A single time-to-crack figure is meaningless without saying who is doing the cracking. The same password can be unbreakable in one setting and gone in a minute in another, and the difference is not the password.

Against a login form that rate-limits you to a few guesses a minute, almost anything survives. Against an offline attack on a database of leaked hashes, where the attacker runs GPUs at their own pace, the numbers collapse. The table assumes an average attack — half the keyspace searched.

Why P@ssw0rd! fails anyway

Nine characters from the full ASCII set is 59.1 bits by the formula, which the table above would place near five weeks of work even for a GPU cluster. In reality it falls immediately, and the reason is the assumption the formula makes.

Entropy measures randomness. The formula computes how many guesses would be needed if every arrangement of nine characters were equally likely — if the password had genuinely been drawn at random. P@ssw0rd! was not. It is one dictionary word, one predictable capitalisation, two substitutions from a very short list of substitutions people make, and one trailing symbol from the two people actually use.

Attackers do not enumerate the keyspace. They start with leaked password lists — billions of real passwords from real breaches — and apply mangling rules that encode exactly these habits. A password built from human patterns is found in the part of the search that runs first, whatever its character count says.

The strength checker exists to show which of those patterns are present in something you typed, rather than to award it a colour.

Passphrases, and where the randomness has to live

A passphrase is strong for the same reason a random string is: the choice was made by dice or by a generator, not by a person. Four words you chose yourself because they mean something to you carry very little entropy. Four words a machine drew from a known list carry a precise, calculable amount.

The list size sets the rate. A 2,048-word list gives log₂(2,048) = exactly 11 bits per word. The EFF long list of 7,776 words gives log₂(7,776) = 12.925 bits per word. That is why 7,776: it is 6⁵, so five ordinary dice select one word with no bias and no computer involved at all.

The security assumes the attacker already has the wordlist and knows the method — and that assumption is the point. The secret is which words the dice chose, not that dice were used.

Four words is not enough any more, and six is the reason

The famous four-word passphrase advice dates from a time when offline cracking was much slower. Four EFF words is 51.7 bits, and a GPU cluster gets through that in about five hours. It is fine for something that will only ever be attacked through a rate-limited login; it is not fine for anything whose hash could leak.

Six words is 77.5 bits and moves the same attack to roughly 35 thousand years. That is why six is the EFF recommendation rather than four, and the two extra words cost you very little — a passphrase is remembered as a phrase, not as a string of characters.

Three habits that add nothing at all

Capitalising the first letter. If you always do it, and everyone always does it, the attacker tries it first. A rule the attacker knows is not entropy — it multiplies the possibilities by one.

Adding ! at the end. Same reason, and the exclamation mark is the single most common trailing symbol in every leaked password corpus. A randomly chosen digit in a randomly chosen position adds log₂(10) = 3.3 bits, which is real but small; a predictable symbol in a predictable place adds zero.

Forced 90-day rotation. Making people change a password every quarter reliably produces Summer2024!, then Autumn2024!, and it has been dropped from modern guidance for precisely that reason. Change a password when there is a reason to — a breach, a suspicion, a shared device — not on a timer.

What happens after the password leaves your hands

A site should never store your password. It should store a hash — a one-way transformation that can verify a password without revealing it. This is why a breach does not automatically hand attackers your credentials, and why the choice of hash decides how much time you have when one happens.

The distinction that matters is speed. General-purpose hashes like MD5, SHA-1 and SHA-256 are designed to be fast, which is exactly wrong for passwords: fast for the site is fast for the attacker, at billions of guesses a second. Password hashes — bcrypt, scrypt, Argon2 — are deliberately slow and memory-hungry, dropping an attacker from 10⁹ guesses a second to a few thousand.

You cannot control which one a site chose. What you can control is that a leak from one site does not open any other, which is what makes reuse the real failure mode. Entropy protects a password; only uniqueness protects an account.

Second factors change the arithmetic entirely

A time-based one-time code turns a stolen password into a partial credential. TOTP works from a shared secret and the current time in 30-second steps, so the code an attacker captures is worthless within half a minute and the password alone opens nothing.

That protection depends on the two factors living in different places. A second factor stored in the same password manager, on the same unlocked device, alongside the password, is a convenience feature rather than a second factor — if that store is compromised, both are.

What to actually do

For accounts you will not type by hand, generate a long random password and let a password manager remember it. Length costs nothing when you are not the one typing it, so there is no reason to be modest — 20 characters of mixed ASCII is 131 bits and outlives every attack model on this page by a margin that stops being meaningful.

For the handful you must remember — your device login, your password manager master password — use a six-word generated passphrase. It is stronger than anything you would have invented and you can actually recall it.

And use a different one everywhere. That single habit prevents more account compromise than every entropy calculation on this page, because the most common way an account falls is not that the password was guessed. It is that it was correct somewhere else first.