How long would that password take to crack?
Password strength is measured in bits of entropy: each extra bit doubles the work. Length beats complexity, decisively.
93% of a five random words
60 bits is stronger than 5 of the 8 references on this page.
Reference figures are measurements and are rounded; the unit conversion behind them is exact.
| Reference | Size | Yours ÷ theirs | Note |
|---|---|---|---|
| 6-digit PIN | 20 bits | 3× | A million possibilities |
| 8 lowercase letters | 37.6 bits | 1.6× | |
| three random words | 38.8 bits | 1.55× | From a 7 776-word list |
| four random words | 51.7 bits | 1.16× | |
| 8 mixed characters | 52.4 bits | 1.15× | |
| five random words | 64.6 bits | 0.929× | |
| 12 mixed characters | 78.7 bits | 0.762× | |
| a 128-bit key | 128 bits | 0.469× | Beyond any conceivable brute force |
Worth knowing
- Each bit of entropy doubles the guessing work. A 60-bit password is a million times harder than a 40-bit one.
- Four random words from a 7 776-word list give 51.7 bits and are far easier to remember than eight random characters, which give 52.4.
Frequently asked
What is password entropy?
The base-2 logarithm of the number of equally likely possibilities. A truly random 8-character password from a 95-character set is log₂(95⁸) = 52.4 bits.
Is "P@ssw0rd1" strong?
No. Entropy assumes randomness, and predictable substitutions are the first thing every cracking tool tries. Its real strength is closer to 10 bits than 50.
How to read this
Entropy figures assume genuinely random selection. A password you invented yourself has far less than the formula suggests.