Password Entropy.

A measure, in bits, of the unpredictability of a password — higher entropy means more guesses are required for an attacker to recover it. It belongs to the Identity & Access category of cybersecurity.

A measure, in bits, of the unpredictability of a password — higher entropy means more guesses are required for an attacker to recover it.

Password entropy quantifies how hard a password is to guess. For a uniformly random string drawn from an alphabet of size N with length L, entropy is L * log2(N) bits. Human-chosen passwords have far lower effective entropy because of dictionary words, predictable substitutions, and reused patterns, as Claude Shannon and later cryptographers have shown. NIST SP 800-63B Appendix A discusses why bit-counting is a weak model in practice and recommends length and breach-list screening over composition rules. Long passphrases such as the four random Diceware words popularized by the EFF (around 51 bits) plus a password manager are the practical way to reach attack-resistant entropy at human-typeable lengths.

Defences for Password Entropy typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Entropy of a password, Guessing entropy.