Skip to content
mathbehind

Password Entropy Explained: Why Length Beats Complexity

Entropy measures how many guesses a random password takes, in bits. The math shows why adding characters helps far more than adding symbols.

By Muhammad Ahmad. Published . 1 min read.

Want to run your own numbers?Password Entropy CalculatorOpen the calculator

Password rules usually ask for complexity: an uppercase letter, a number, a symbol. The math of entropy shows that length matters much more, as long as the password is truly random.

What entropy measures

A random password of length L, drawn from N possible characters, has N^L possible values. Entropy is log₂ of that number, so it equals L × log₂ N bits. Each extra bit doubles the number of guesses an attacker needs.

12 random letters and digits, fast offline attack
  1. Bits per character

    log₂ 62equals5.95

  2. Entropy

    12 × 5.95equals71.5 bits

  3. Average time

    62¹² ÷ 2 ÷ 10,000,000,000/sequals5,112 years

Length vs complexity

Adding symbols grows the character set from 62 to 95, which raises entropy per character from 5.95 to 6.57 bits. Adding one more character to a letters-and-digits password adds a full 5.95 bits. So a 14-character password of letters and digits (83.4 bits) is stronger than a 12-character password with symbols (78.8 bits).

Attack speed matters too

  • Online logins are rate-limited, so attackers get only a few guesses per second per account.
  • If a password database is stolen, attackers guess offline. Slow hashes such as bcrypt allow thousands of guesses a second; fast, unsalted hashes allow billions.

That is why the same password can be safe for decades against one attack and weak against another.

The catch: humans aren't random

All of this assumes random characters. Passwords people invent follow patterns, such as dictionary words, names, dates and predictable substitutions, and attackers try those patterns first. A made-up password can have far less real entropy than its length suggests.

Tip: Let a password manager generate 16 or more random characters. At 62 characters per position, that is over 95 bits of entropy.