Password Strength Is About Entropy

P@ssw0rd! meets almost every password rule ever written: upper case, lower case, a number, a symbol, over eight characters. It is also one of the first passwords any attacker tries. The rules we were taught measure the wrong thing. What actually makes a password hard to guess is entropy — and once you think in those terms, the advice changes completely.

What entropy really means

Entropy is a measure of unpredictability, counted in bits. Each bit doubles the number of possibilities an attacker has to work through. A password with 40 bits of entropy has about a trillion possibilities; one with 60 bits has about a quintillion — a million times more. Every extra bit literally doubles the effort to guess it.

The crucial insight is that entropy depends on how the password was created, not how it looks. P@ssw0rd! looks complex, but it was made by a predictable human process: take a common word, capitalise the first letter, swap letters for lookalike symbols, add a number and a bang at the end. Attackers know that process and automate it. The "complexity" is an illusion because the recipe is common.

Why the old rules backfire

Mandatory complexity rules — one upper, one number, one symbol — were meant to increase entropy. In practice they shrink it, because everyone satisfies them the same way:

• Capitalise the first letter.
• Put the number and symbol at the end.
• Substitute a→@, s→$, o→0, i→1.

An attacker's software applies exactly these transformations to a dictionary of common words. So P@ssw0rd!, Summer2024! and Welcome1$ fall in seconds, despite "passing" every rule. The rules did not add unpredictability; they added a predictable pattern on top of a predictable word.

This is why modern guidance from bodies like NIST dropped mandatory composition rules and arbitrary forced resets, and shifted the emphasis to length and to screening against known-breached passwords.

Length beats complexity

Because entropy grows with each additional character, length is the most powerful lever you have. A longer password from a larger, unpredictable set of characters is exponentially harder to crack than a short "complex" one.

This is the logic behind passphrases: four, five or six random words strung together. correct-horse-battery-staple is famous for a reason. It is long, easy to remember, and — critically — if the words are chosen randomly rather than to make a sentence, it carries far more entropy than a tortured eight-character string. The emphasis on random matters: a memorable phrase from a song or quote has almost no entropy because it already exists in the world for an attacker to try.

How password strength meters really work

A good strength meter does not just count character types. It estimates how many guesses an attacker would need, by recognising the shortcuts people take:

• It spots dictionary words, names and keyboard walks (qwerty, asdf).
• It recognises the common substitutions and counts @ as little better than a.
• It notices years, dates and sequences.
• It penalises repetition and predictable structure.

That is why a well-built checker rates P@ssw0rd! as weak despite its symbols, and rates a long random passphrase as strong despite having no symbols at all. The meter is estimating entropy as the attacker would exploit it, not counting character classes.

Practical advice that actually helps

• Length first. Aim for long — a passphrase of several random words, or 16+ random characters.
• Randomness, not cleverness. The strength comes from unpredictability. A generator produces real randomness; your brain does not.
• One password per site, never reused. The biggest real-world risk is not cracking — it is credential stuffing, where a password leaked from one breached site is tried everywhere else. Reuse turns one breach into many.
• Use a password manager. It makes long, unique, random passwords practical, because you no longer have to remember them.
• Turn on two-factor authentication wherever it is offered. Even a perfect password can be phished; a second factor blocks most account takeovers.

The mindset shift

Stop asking "does this password look complex?" and start asking "how predictable was the way I made it?" A random passphrase you can actually remember beats a symbol-stuffed word you cannot. Use a strength checker to see how an attacker would score your choice, a generator or passphrase tool to create something genuinely unpredictable, and a password manager so that doing the right thing is also the easy thing.