# Password entropy: what “bits” really mean, and why length beats symbols

> An 8-character password with every symbol on the keyboard falls in days. A six-word passphrase of plain lowercase words outlasts the age of the universe. The difference is a number called entropy, and it is easy to read once you see it drawn.

Published 2026-10-08 by Toolcloak. 3 minute read. Original: https://toolcloak.pages.dev/articles/password-entropy-bits-guesses-and-why-length-beats-symbols
Related free tool: [Password Entropy Calculator](https://toolcloak.pages.dev/tools/password-entropy-calculator)

Websites love to tell you to add a capital letter, a number and a symbol. They rarely tell you the one thing that matters more: how long it is. Entropy, measured in bits, is the honest score, and it explains why.

> **In short**
> - Entropy = length × log₂(size of the character set). Each extra **bit doubles** the work for an attacker.
> - Going from 8 to 12 characters adds far more than switching from lowercase to all symbols.
> - A random six-word passphrase is about **77 bits**, about as strong as a random 12-character mix of all keys, and far easier to remember.
> - The formula only holds for **randomly chosen** passwords. A human-made “P@ssw0rd!” is far weaker than its length suggests.

## What a bit of entropy means

Entropy counts how many equally likely passwords an attacker would have to try. One bit means 2 possibilities, two bits means 4, ten bits means 1,024. So 40 bits is about a trillion, and 80 bits is a trillion times a trillion. The number grows so fast that every added bit doubles the attacker's work.

> **The formula:** Bits = length × log₂(characters available). Lowercase only has 26 characters, about 4.7 bits each. All printable keys have 94, about 6.55 bits each. A 4-word phrase from a 7,776-word list gives about 12.9 bits per word.

## Length against variety

Here is the surprising part. Look at how many bits each choice buys.

**Bits of entropy for random passwords**

|  | Value |
| --- | --- |
| 8 lowercase | 38 |
| 8 all keys | 52 |
| 12 lowercase | 56 |
| 12 all keys | 79 |
| 16 lowercase | 75 |
| 6 random words | 78 |

*Twelve plain lowercase letters (56 bits) beat eight characters of every kind (52 bits). Sixteen lowercase letters beat almost anything short.*

## How long would it take to crack?

Assume the worst realistic case: an attacker has stolen a database of weakly hashed passwords and can test **10 billion guesses a second** on their own hardware. On average they find the password after trying half of all possibilities.

| Random password | Bits | Average time to crack |
| --- | --- | --- |
| 8 lowercase letters | 37.6 | about 10 seconds |
| 8 letters and digits (62 symbols) | 47.6 | about 3 hours |
| 8 of all 94 keys | 52.4 | about 3.5 days |
| 10 of all 94 keys | 65.5 | about 85 years |
| 12 letters and digits | 71.5 | about 5,000 years |
| 12 of all 94 keys | 78.7 | about 750,000 years |
| 16 lowercase letters | 75.2 | about 69,000 years |
| 6 random words | 77.5 | about 350,000 years |

*Average time = half the possibilities ÷ 10 billion guesses a second. Slow, properly salted hashes make real-life numbers far longer. Fast, unsalted ones can be worse.*

Try it: [Password Entropy Calculator](https://toolcloak.pages.dev/tools/password-entropy-calculator). Type or paste a password to see its bits and the time it would take, all calculated in your browser.

## Where a six-word passphrase sits

**Bits of entropy and what they mean**

| Zone | Range |
| --- | --- |
| Weak | under 40 |
| Fair | 40 to 60 |
| Strong | 60 to 80 |
| Very strong | 80 and up |

*The needle shows a random six-word passphrase. A random 16-character mix of all keys is about 105 bits.*

## Why human-made passwords are weaker than the maths says

The formula assumes every password in the set is equally likely. People are not random. “Password1!” looks like 11 characters with four character types, but attackers try patterns like a word, a capital, a number and a symbol early. Its real strength is closer to a few thousand guesses than a few trillion.

**Looks strong, is not**

| Chosen by a person | Chosen by a generator |
| --- | --- |
| Summer2026! | random 6 words |
| Word + year + symbol is the first pattern tried | Every word is equally likely |
| Falls to a pattern-based attack quickly | Full entropy, easy to type and remember |

*The password generator makes both kinds. Random is what makes the entropy number true.*

## Practical rules

1. **Let a generator choose.** Random beats clever every time. See [Your password is not weak because it is short](https://toolcloak.pages.dev/articles/your-password-is-not-weak-because-it-is-short).
2. **Aim for 70 bits or more** for anything that matters: email, banking, your password manager.
3. **Use a long passphrase** where you must type it from memory, and a long random string everywhere else.
4. **Never reuse.** A strong password leaked from one site is a master key to all the others that share it.
5. **Turn on two-step login.** Entropy protects against guessing. It does not protect against phishing.

## Frequently asked questions

### What is password entropy?

A measure of how unpredictable a password is, in bits. Each bit doubles the number of guesses an attacker needs. It equals length times log₂ of the character set size, for randomly chosen passwords.

### How many bits of entropy is a good password?

At least 60 bits for ordinary accounts and 70 or more for important ones such as email, banking and a password manager.

### Is a longer password better than a complex one?

Usually yes. Twelve random lowercase letters (about 56 bits) beat eight characters of every type (about 52 bits), and length keeps paying off as you add more.

### Are passphrases secure?

Yes, if the words are chosen randomly. A six-word passphrase from a 7,776-word list is about 77.5 bits, about the same as a random 12-character mix of all keys (78.7 bits).

### Does the cracking time apply to my online accounts?

Not directly. Websites limit login attempts, so online guessing is far slower. The cracking-time figures apply when an attacker has a stolen database of hashed passwords.