Calculate password entropy in bits from character set size and password length.
Password entropy measures how many bits of uncertainty an attacker faces when brute-forcing a password, calculated as the password length multiplied by the base-2 logarithm of the character set size — each additional character multiplies the total number of possible passwords by the charset size, so entropy grows linearly with length but the actual search space grows exponentially. A password drawing from all four common character classes (26 lowercase + 26 uppercase + 10 digits + 32 special characters = 94 possible characters per position) reaches meaningfully higher entropy per character than one restricted to lowercase letters alone, which is why both length and character diversity matter for resistance to brute-force attacks.
Password entropy
entropy_bits = length × log2(charset_size)
Usually yes — entropy grows linearly with length but only logarithmically with charset size, so adding characters to a password (increasing L) generally buys more entropy than adding another character class to a short password. A 20-character lowercase-only password (94 bits) beats a 10-character password using all four classes (66 bits).
Yes — this formula assumes each character is chosen independently and uniformly at random from the specified character set. Human-chosen passwords (even long ones) are far less random due to predictable patterns like dictionary words, dates, and keyboard walks, so their true entropy is much lower than this formula would suggest.
NIST and most security guidance consider 60+ bits reasonable for typical accounts, 80+ bits strong for sensitive systems, and 128 bits effectively immune to brute force for the foreseeable future given current and projected computing power — password managers generating long random strings comfortably clear these bars.