What the entropy number actually means
Entropy measures how many possible outputs a generator could have produced, expressed as a power of two. A random password built from a pool of characters has entropy = length × log₂(pool size) — every character you add multiplies the number of possible passwords, and every bit of entropy you gain doubles how many guesses a brute-force attack needs on average.
Entropy = Length × log₂(pool size)
16 chars, upper+lower+digits+symbols (89-char pool):
16 × log₂(89) ≈ 16 × 6.48 ≈ 103.6 bits
That 103.6-bit result lands in the "Strong" band this tool reports. Notice that the pool size barely matters compared to length — going from 89 possible characters down to just digits (10) only costs about 3.3 bits per character, while cutting the length in half costs 50+ bits. Length is doing almost all of the work.
Turning entropy into a crack-time estimate
The crack time shown alongside each result assumes a brute-force attacker guessing 10 billion combinations per second — a rough, deliberately conservative benchmark for offline attacks against a stolen password hash on capable hardware. It's not a guarantee, just a way to make an abstract bit count feel concrete.
Combinations = 2^entropy
Estimated seconds = Combinations ÷ 10,000,000,000
In practice, most account breaches don't come from brute-forcing a strong password at all — they come from phishing, reused passwords exposed in an unrelated breach, or malware. A high entropy score protects against one specific threat model; it doesn't substitute for unique passwords per account and multi-factor authentication where it's offered.
Why passphrase strength depends heavily on word count
A passphrase built from this tool's word list follows the same logic as a random password, just with words instead of characters: entropy = number of words × log₂(word list size). Because the built-in list has a little over 100 words, each additional word adds roughly 6.7 bits — noticeably less per unit than a random character does, which is why passphrases need more words than a random password needs characters to reach the same strength.
| Words | Approx. entropy | Strength band |
|---|---|---|
| 4 | ~26.8 bits | Weak |
| 6 | ~40.2 bits | Fair |
| 8 | ~53.6 bits | Fair-Good |
Turning on "Add a number at end" tacks on roughly another 6.6 bits. If a passphrase is the login for something you'd rather keep locked down, lean toward 6-8 words rather than the shorter end of the range — a real diceware-style word list with thousands of entries would need fewer words for equivalent strength, but more words is the safe compensation with a smaller list.
A few habits that matter more than any single password
- Never reuse a password across accounts — one breached site shouldn't be able to unlock every other account you own.
- Use a password manager. Remembering dozens of strong, unique passwords isn't realistic; a manager generates and stores them so you don't have to.
- Turn on multi-factor authentication wherever it's offered — it protects an account even if the password itself is ever exposed.
- Excluding ambiguous characters (0/O, l/I/1) is a reasonable convenience for passwords you might need to type by hand, but skip it when copy-pasting from a manager.