Reading the numbers
Entropy measures how many equally likely options an attacker has to search, on a doubling scale. Each extra bit doubles the work. 40 bits is about a trillion possibilities; 80 bits is a trillion times more than that.
Honest assumptions
- The attacker knows everything but the dice. They know the wordlist, the number of words and your separator. Only the random choices count.
- Averages, not guarantees. An attacker could guess right on the first try, with odds of 1 in 2bits. At 77 bits that's about 1 in 1023.
- Guess rates are assumptions. We show three illustrative speeds. The real one depends on how the service stores passwords, and that's out of your hands.
- Reuse beats entropy. A 100-bit passphrase used on a site that leaks it in plain text is worth zero bits everywhere else you used it.
Ready for one? The passphrase generator shows this maths live for every phrase it makes.
Questions
How is passphrase entropy calculated?
For words chosen uniformly at random, entropy in bits = number of words × log2(list size). Six words from a 7,776-word list give 6 × 12.925 = 77.5 bits. Add log2 of the options for anything else chosen at random, such as 3.32 bits for a random digit.
How long would it take to crack my passphrase?
On average an attacker must try half of all possibilities, so time ≈ 2^(bits − 1) ÷ guesses per second. The guess rate depends on the attack: a rate-limited login allows a handful per hour, a leaked database with a slow hash maybe thousands to hundreds of thousands per second, and a fast hash on GPUs billions or more.
Why can't a strength meter tell me the entropy of a password I made up?
Entropy is a property of the process that chose the password, not of the string. "sunflower-garden-summer" and "dagger-onion-wrist" have the same length, but a person is far more likely to pick the first. Meters can only estimate by guessing how predictable a string looks; for random words the exact figure is known.
How many bits do I need?
Roughly: 50–60 bits for accounts protected by rate limiting or 2FA, 70–80 bits for a password-manager master password, email, or disk encryption, and 90+ if you want a wide margin for decades. That is five, six and seven EFF long-list words.