When a password manager or security tool tells you a password is "weak" or "strong", it's usually measuring entropy. Here's what entropy means, how to calculate it, and why it matters more than complexity requirements.

What is password entropy?

Entropy, in this context, measures the unpredictability of a password — specifically, how much information an attacker would need to guess it. It's measured in bits.

The formula:

entropy = log₂(pool_size) × password_length

Enter fullscreen mode

Exit fullscreen mode

Where pool_size is the number of possible characters.

For an 8-character password using only lowercase letters (26 characters):

entropy = log₂(26) × 8 = 4.7 × 8 ≈ 37.6 bits

Enter fullscreen mode

Exit fullscreen mode

For an 8-character password using lowercase + uppercase + digits + symbols (95 characters):

entropy = log₂(95) × 8 = 6.57 × 8 ≈ 52.5 bits

Enter fullscreen mode

Exit fullscreen mode

Higher entropy = more guesses needed to crack = stronger password.

Why length beats…