What Is Password Entropy? A Simple Explanation

When you use our password generator, you'll see a strength meter that goes from "Weak" to "Excellent". Under the hood, that meter is measuring something called entropy — a number that tells you how hard your password would be for an attacker to guess. Let's break down what it actually means.

The coin flip analogy

Imagine you're creating a password by flipping a coin. Heads = 1, tails = 0. After one flip, there are 2 possible outcomes — that's 1 bit of entropy. After two flips, there are 4 possible outcomes — that's 2 bits. After ten flips, there are 1,024 possible outcomes — 10 bits.

Entropy is simply the number of coin flips it would take to generate the same number of possibilities as your password. More bits = more possible passwords = harder to crack.

The formula

For a randomly generated password, entropy is calculated like this:

Pool size is how many different characters each position could be. If you're using lowercase letters only, that's 26. Add uppercase and it's 52. Add numbers and symbols and you're up to about 95.

Length is how many characters your password has. Each additional character multiplies the total combinations by the pool size.

Entropy in practice

Here's how different passwords stack up:

Password Type	Example	Entropy	Rating
4-digit PIN	7291	~13 bits	Weak
8 chars, lowercase	mxkqfvbw	~38 bits	Fair
12 chars, mixed	kT9#mPx2vR!q	~79 bits	Strong
20 chars, all types	Bx$4kM!qR2pL#v8Nw&jT	~131 bits	Excellent
5 syllables, pronounceable	bov-kel-zim-tof-na	~44 bits	Fair
7 syllables + number + caps	Bov-Kel-Zim-Tof-Na-Wex-Jup-83	~89 bits	Excellent

How many bits do you need?

There's no single magic number, but here's a practical guide:

Bits	Protection Level	Good For
~35 or less	Weak	Not recommended for anything important
36–59	Fair	Low-value accounts, throwaway signups
60–79	Strong	Most online accounts
80+	Excellent	Email, banking, password manager master password

Why pronounceable passwords have lower entropy — and that's okay

You might notice that a pronounceable password like bov-kel-zim has lower entropy per character than a random string like x7#Qm. That's because each syllable draws from a smaller pool (consonant-vowel-consonant patterns) than a fully random character.

But here's the trade-off: pronounceable passwords are dramatically easier to remember and type. You can compensate by adding more syllables, enabling capitalization, and appending a number. Seven capitalized syllables with a number gives you roughly 89 bits — more than enough for almost any use case.

The bottom line

Entropy is the only number that truly measures password strength. It doesn't care about tricks like replacing letters with symbols or adding an exclamation mark at the end — it only cares about how many possibilities an attacker would need to search through. Aim for 60+ bits for everyday accounts and 80+ bits for anything critical.