What is Password Entropy?

John Spacey, updated on July 29, 2023

Password entropy is a measure of the strength of a password based on information theory. This is a function of the permissible character set and password length that is expressed in bits. As bits can be either 0 or 1, a 50 bit password would require a maximum of 2⁵⁰ tries to guess with certainty.

Generally speaking, password entropy is good at establishing an upper bound of guesses for a password. It is naive when it comes to the actual number of guesses. Password entropy looks only at the length and character set of a password. It doesn't consider the possibility of intelligent guesses. For example, most password guessing algorithms would guess a common password such as p@ssw0rd right away.

Overview: Password Entropy
Type	Authentication Information Security
Definition (1)	A measure of the strength of a password based on the number of bits that are required to represent it. This is a function of character set and password length.
Definition (2)	A measure of password strength based on information theory that represents the maximum number of guesses a brute-force method would require to guess a given password.
Related Concepts	Brute Force Strong Password Authentication Information Security