Passwords, entropy and the math behind strong credentials
Length beats complexity, but only when the characters are actually random. A practical explanation of entropy for people who have to choose passwords.
Entropy is the only number that matters
Password strength is not about looking complicated. It is about how many guesses an attacker needs. Entropy measures that in bits: each additional bit doubles the search space.
For a randomly generated password, entropy is roughly:
entropy = length × log2(alphabet size)
A 12-character password from 94 printable characters has about 78 bits. A 16-character password from 26 lowercase letters has about 75 bits. Both are strong; the second is easier to type.
Why "P@ssw0rd!" is weak
Human-chosen substitutions follow predictable patterns. Attack tools know that a becomes @ and o becomes 0. A dictionary word with two substitutions has far less effective entropy than its character count suggests.
Rules that force symbols and capitals mostly create predictable shapes. Length and randomness do the real work.
Passphrases vs random strings
- Passphrases (four or five random words) are memorable and long. Good for accounts you type often.
- Random strings are shorter for the same entropy. Good for API keys and machine credentials.
- Never reuse either across services. One breach should not cascade.
Generate both with the Password Generator, and exclude ambiguous characters if you will read the password aloud or retype it.
Practical targets
| Context | Target entropy |
|---|---|
| Personal account | 70+ bits |
| Admin or financial | 90+ bits |
| API key | 128+ bits |
| Recovery code | 100+ bits, single use |
Storage and rotation
Entropy only helps if the secret is stored safely. Use a password manager, enable two-factor authentication, and rotate credentials that were ever pasted into a chat, a ticket or a screenshot.
A short checklist
- Generate, do not compose
- Prefer length over symbol soup
- Use a unique secret per service
- Store in a manager, not a note
- Treat any pasted secret as compromised
Strong passwords are a design decision, not a typing skill.