How Long Should a Password Be? Entropy Explained Simply

What entropy measures

A password's strength is measured in bits of entropy, which is a way of counting how many guesses an attacker would need if they tried every possibility. Each bit doubles the number of possibilities. A password with 40 bits has about a trillion possibilities; one with 41 bits has twice that.

For a randomly generated password, entropy is the length multiplied by the number of bits each character carries, and each character carries the base-2 logarithm of how many symbols it could have been.

entropy = length x log2(size of character set)

lowercase only (26 symbols)      4.70 bits per character
letters and digits (62 symbols)  5.95 bits per character
all printable (94 symbols)       6.56 bits per character

Length beats complexity: the numbers

Adding symbol types makes each character worth a little more. Adding characters adds a whole character's worth every time. Compare:

8 characters, every symbol type     52.4 bits
16 characters, lowercase only       75.2 bits
20 characters, lowercase only       94.0 bits
16 characters, every symbol type   104.9 bits

Sixteen plain lowercase letters beat eight characters using every symbol type, by more than 20 bits. And because every bit doubles the work, 20 bits is not a small margin: it is about a million times as many guesses.

The formula only holds for random passwords

The numbers above assume every character was chosen at random. Human-chosen passwords are nothing like that. People capitalise the first letter, put the number at the end, and swap an a for @. Attackers know all of these habits and try them first, so P@ssw0rd1! has the character types of a strong password and almost none of the strength.

This is the real case against complexity rules: they push people toward predictable substitutions that look strong to a rule checker and are cheap to guess.

Passphrases: length you can remember

For the few passwords you actually have to type, a passphrase of several random, unrelated words is a good compromise. Picked at random from a list of 7,776 words, each word adds about 12.9 bits.

5 random words  64.6 bits
6 random words  77.5 bits

Six random words reach the same strength as a 16-character lowercase string and are far easier to remember. The words must be random, though. A line from a song or a phrase you chose yourself is much weaker than the count of words suggests.

So how long is enough?

• For anything that matters, aim for at least 16 random characters, which lands around 75 to 105 bits depending on the character set.
• For a password manager's master password, which you must type and remember, use a passphrase of six or more random words.
• For anything stored in a manager that you never type, there is no reason not to go to 20 or more characters.

The bigger risk is reuse

All of this assumes an attacker guessing. In practice most accounts are not broken by guessing; they are broken because the same password was used on another site that leaked. Once one service is breached, attackers try that email and password everywhere else. A 30-character password reused across sites is weaker in practice than a modest unique one.

The habit that actually protects you is unique passwords everywhere, which is only practical with a password manager. Generate a long random password for each site, let the manager remember it, and keep one strong passphrase for the manager itself.