🔢 Password Entropy Explained: Why a 12-Character Password Isn't Always Strong
On this page
- What Is Password Entropy?
- How Password Entropy Is Calculated
- Theoretical Entropy vs Real-World Cracking Time
- Why Human-Chosen Passwords Have Lower Effective Entropy
- Passphrases: High Entropy That Humans Can Remember
- How to Generate Maximum-Entropy Passwords
- Password Managers: The Only Practical Solution
- Frequently Asked Questions
A 12-character password made of lowercase letters can be cracked in under 4 hours by a modern GPU cluster running 10 billion guesses per second. The culprit is not the length, it is entropy, the single number that determines how unpredictable your password really is. Password entropy measures the randomness of a password in bits: the higher the entropy, the longer it takes to crack, regardless of how many characters the password contains.
What Is Password Entropy?
Password entropy is a measure of how many guesses an attacker would need to exhaust all possible combinations for a given password. It is expressed in bits: each additional bit doubles the number of possible passwords. At 40 bits of entropy, there are roughly 1 trillion possible combinations. At 80 bits, that number squares to about 1.2 quadrillion, and it grows exponentially from there.
The concept comes from information theory, where Claude Shannon defined entropy as the amount of unpredictability in a message. Applied to passwords, a high-entropy password is one that a computer cannot reasonably predict through exhaustive guessing within any practical timeframe. The formula is deceptively simple, what trips people up is the gap between theoretical entropy (what the formula gives) and effective entropy (what an attacker actually has to work through).
NIST SP 800-63B (2017, revised 2024): "Memorized secrets shall be at least 8 characters in length... verifiers SHOULD permit subscriber-chosen memorized secrets at least 64 characters in length." NIST explicitly moved away from complexity mandates toward entropy-based guidance, because complexity rules produce predictable patterns that attackers know.
How Password Entropy Is Calculated
The formula is:
Entropy (bits) = Length × log₂(Character Set Size)
The character set size (N) is the number of unique characters that could appear at each position. The table below shows what different character sets contribute:
| Character Set | Size (N) | Bits per Character | 16-char total entropy |
|---|---|---|---|
| Lowercase only (a–z) | 26 | 4.7 bits | 75 bits |
| Lowercase + uppercase | 52 | 5.7 bits | 91 bits |
| Alphanumeric (a–z, A–Z, 0–9) | 62 | 5.95 bits | 95 bits |
| Full ASCII printable (letters, digits, symbols) | 95 | 6.57 bits | 105 bits |
Moving from lowercase-only to full ASCII increases bits per character from 4.7 to 6.57, a 40% improvement in randomness per character. That is why symbol and number requirements exist in password policies, even when they feel arbitrary. More importantly, length multiplies everything: every extra character adds another 6.57 bits if you are using the full character set, which translates to 95 times more combinations per character added.
Theoretical Entropy vs Real-World Cracking Time
Raw entropy numbers matter most when translated into actual cracking time. A modern GPU cluster can test approximately 10 billion (10¹⁰) passwords per second against MD5-hashed credentials. For stronger algorithms like bcrypt (cost factor 12), that rate drops to roughly 10,000 guesses per second.
| Password Example | Entropy | Crack time (MD5, 10B/s) | Crack time (bcrypt) |
|---|---|---|---|
password123 (common word+digits) | ~10 bits effective | <1 second | <1 second |
Tr0ub4dor&3 (11 chars, mixed) | ~28 bits effective | <1 second | ~3 days |
| Random 12-char, full ASCII | ~79 bits theoretical | ~1 billion years | Effectively infinite |
| Random 16-char, full ASCII | ~105 bits theoretical | Effectively infinite | Effectively infinite |
Notice the distinction between Tr0ub4dor&3 (which looks complex) and a random 12-character password. The former has low effective entropy because its construction follows predictable human patterns, dictionary word, leet substitutions, appended number, all of which appear in modern cracking wordlists. The latter achieves theoretical entropy because a CSPRNG chose every character without pattern.
Bruce Schneier, security technologist and author of Secrets and Lies: "Humans are bad at generating random passwords. We think we're being clever with 'p@ssw0rd', but attackers ran those substitutions through their wordlists a decade ago."
Why Human-Chosen Passwords Have Lower Effective Entropy
The formula above assumes truly random character selection from the full character set. Humans do not select randomly, and modern cracking rigs are tuned to exploit exactly that predictability:
- Dictionary words: "sunshine" looks like 8 random characters (37.6 bits theoretical) but is one of the top 10,000 most common passwords, effective entropy near zero.
- L33t substitutions: Replacing "a" with "@" or "e" with "3" adds perhaps 2–3 bits in practice because these substitutions are pre-loaded in every serious cracking tool, including Hashcat rule sets available freely online.
- Required-complexity patterns: "Password1!" satisfies uppercase + lowercase + digit + symbol requirements but appears in every wordlist. NIST researchers estimate its effective entropy at under 10 bits.
- Personal information: Birthdays, pet names, and sports teams are guessable from public social media. Targeted attacks enumerate personal data before running brute force, collapsing effective entropy dramatically.
The Hive Systems 2025 Password Table, updated annually, shows that an 8-character password using common human patterns is now cracked near-instantly on consumer hardware. Even "complex-looking" human-chosen passwords rarely exceed 30–40 bits of effective entropy, regardless of what the theoretical calculation says.
Passphrases: High Entropy That Humans Can Remember
Passphrases offer a middle path: entropy high enough to be practical, yet memorable. A passphrase drawn from the EFF's 7,776-word Diceware list contributes approximately 12.9 bits per word:
- 4 random words: ~51.7 bits, marginal for sensitive accounts
- 5 random words: ~64.6 bits, acceptable for most accounts
- 6 random words: ~77.5 bits, comparable to a random 12-char ASCII password
The key word is random. "correct horse battery staple" (the xkcd passphrase) is now famous and therefore in every wordlist. Use a proper random word generator, not your imagination, or the effective entropy collapses toward zero for the same reason human-chosen passwords fail.
How to Generate Maximum-Entropy Passwords
There are two reliable levers for maximising entropy:
- Increase length. Every extra character multiplies the search space by N. Going from 12 to 16 characters with full ASCII adds 26 bits, multiplying guesses required by about 67 million.
- Use a cryptographically secure random generator (CSPRNG). A CSPRNG draws from the full character set without any pattern, achieving theoretical entropy. Human choices never do.
Both levers together, long + random, put a password beyond the reach of any realistic attack today and well into the future even as computing power grows.
Password Managers: The Only Practical Solution
The only realistic way to have high-entropy, unique passwords for every account is to use a password manager. No person can memorise a random 16-character string for fifty websites, but a manager generates, stores, and autofills them automatically without any effort.
NordPass is a zero-knowledge password manager built by the team behind NordVPN. Its built-in password generator defaults to 16–20 random characters across all character types, producing passwords consistently above 100 bits of entropy. Credentials are stored under XChaCha20 encryption, a cipher favoured for its resistance to side-channel attacks and recommended for post-quantum preparedness. NordPass also flags password reuse across your vault and automatically checks stored credentials against breach databases, alerting you when a site you use has been compromised.
For anyone still relying on human-chosen passwords or browser autofill, switching to a dedicated password manager is the single highest-leverage security improvement available in 2026. The entropy problem is not a willpower problem, it is a tool problem, and the tool exists.
Frequently Asked Questions
What is a good password entropy score?
Security researchers and NIST guidelines suggest a minimum of 80 bits of entropy for sensitive accounts such as banking, email, and healthcare portals. For high-value targets, 100+ bits is the practical standard. A randomly generated 16-character password using uppercase, lowercase, numbers, and symbols achieves approximately 105 bits of theoretical entropy.
Does password length or complexity matter more?
Length has a larger impact, but both matter. Adding one character to a full-ASCII password adds 6.57 bits and multiplies possible combinations by 95. Adding a new character type (say, symbols to an alphanumeric-only password) increases bits-per-character but has diminishing returns once all types are included. The practical recommendation: prioritise length, then use all character types.
Is a passphrase better than a random password?
A six-word Diceware passphrase (~77 bits) is roughly equivalent in entropy to a random 12-character full-ASCII password (~79 bits). The passphrase is easier to memorise; the random string is shorter to type. Either choice vastly outperforms human-invented passwords, the critical requirement is that the selection is genuinely random, not chosen by a human.
Can I check the entropy of my existing passwords?
Yes, entropy estimators check your password against known patterns, common wordlists, leet substitutions, and keyboard walks to estimate effective entropy. NordPass includes a password health dashboard that flags weak, reused, and breached passwords. However, no tool measures effective entropy perfectly: it depends partly on what an attacker knows about you specifically.
