Strong passwords and passphrases: what entropy means
2 min read · Updated 3 October 2026
A password is strong when an attacker would have to make an impractical number of guesses to find it. For a randomly generated password, that number can be calculated exactly, and it is usually written as bits of entropy.
Bits of entropy
If each character is chosen uniformly at random from a set of N symbols, every character adds log₂(N) bits:
| Character set | Symbols | Bits per character |
|---|---|---|
| Digits | 10 | 3.32 |
| Lowercase letters | 26 | 4.70 |
| Upper + lower + digits | 62 | 5.95 |
| Upper + lower + digits + 32 symbols | 94 | 6.55 |
A 16-character password from the 94-symbol set has about 16 × 6.55 ≈ 105 bits. Each extra bit doubles the number of guesses needed.
This calculation only holds for random passwords. A human-chosen "P@ssw0rd2026!" has far less real entropy than its length suggests, because attackers try common words, substitutions and years first.
Passphrases
A passphrase is several random words, such as carrot-ledger-cobalt-humid-ritual. With the EFF's list of 7,776 words (designed for dice), each word adds log₂(7776) ≈ 12.9 bits. Five words give about 64.6 bits; six words about 77.5 bits. They are much easier to type on a phone and to remember than random symbols.
The words must be chosen randomly by a generator, not by you: "correct horse battery staple" is now in every attacker's list precisely because people copied it.
How much is enough?
- For an account protected by rate limiting and two-factor authentication, 60 to 80 bits is plenty.
- For a password manager's master password or disk encryption, which an attacker can attack offline, aim for 80 bits or more: a six- or seven-word passphrase works well.
- Most important of all: use a different password for every site, stored in a password manager.
Generating them safely
The password and passphrase generator uses your browser's cryptographic random number generator and avoids "modulo bias" (which would make some characters slightly more likely). Nothing is stored or sent: once you leave the page, the generated values exist only where you saved them.