How passphrase entropy is calculated

Entropy measures the process, not the password

A single password has no entropy. The phrase "correct horse battery staple" is not strong or weak in itself — what matters is how it came to exist. If a machine drew four words uniformly from a list of 7,776, it is one of about 3.7 million million equally likely results. If somebody picked it because they had seen it in a cartoon, it is one of a handful, and no amount of arithmetic changes that.

So every figure on this site describes the generator and its settings, under the assumption that an attacker knows those settings and is reduced to guessing the random draws. That assumption is the conservative one. The list, the word count, the length range, the separator and the case rule are all published on this page, so treating them as secret would inflate every number here.

The formula

For a choice made uniformly from N equally likely possibilities, the entropy is log2(N) bits. Each independent choice adds its own bits, so k independent draws from the same pool of N give:

bits = k × log2(N)

That is the entire calculation for a passphrase. The log base 2 is what turns "how many possibilities" into "how many bits", and bits are convenient because each extra bit doubles the work an attacker faces. Seventy bits is twice as hard as sixty-nine, and about a thousand times harder than sixty.

The same formula covers a random character password, with N the size of the character set and k the length: twenty characters drawn from a set of 80 gives 20 × log2(80), which is about 126 bits.

Worked examples for the three lists

The EFF long list holds 7,776 words. log2(7,776) is about 12.925, so each word carries roughly 12.9 bits. Six words give 6 × 12.925, about 77.5 bits — the default on this page, and the EFF’s own recommendation for that list. Seven words give about 90.5, eight about 103.4.

Both short lists hold 1,296 words. log2(1,296) is about 10.34, so six words give about 62 bits, seven about 72.4, and eight about 82.7. That is why the short lists want an extra word or two to match the long one.

Five words from the long list come to about 64.6 bits — almost exactly the same as six from a short list. The two routes to a given strength are genuinely interchangeable; pick whichever produces words you find easier to type.

What the length range does to the figure

The minimum and maximum word length filter the list before any word is drawn, so N in the formula is the number of words that survive the filter, not the size of the file. The page recalculates this as you change the range and shows the surviving count, so the entropy figure is always about the pool actually in use.

This is a small effect for sensible ranges and a large one for extreme ones. Restricting the long list to words of exactly four letters leaves a few hundred candidates, dropping each word from about 12.9 bits to about 8 — which turns a six-word passphrase from roughly 77 bits into roughly 48. The page will show that, and at that point it is telling you to widen the range or add words.

What the separator and case options add

A fixed separator adds nothing. If every gap is a hyphen, an attacker who knows the settings puts hyphens in every gap too; there is no choice for them to guess.

The random separator option is different. Each gap independently takes one of five characters, so each gap adds log2(5), about 2.32 bits. A six-word passphrase has five gaps, which is about 11.6 extra bits — a real gain, and the page counts it.

The same logic applies to case. Lower, upper, capitalised and alternating are fixed rules and add nothing. Random case flips an independent coin per word, so it adds exactly one bit per word: six bits on a six-word passphrase. That is counted too.

It is worth noticing how modest these are. Random case and random separators together add about 17 bits to a six-word passphrase, while a seventh word adds about 13 on its own and is far easier to remember. Adding words is almost always the better lever.

What an acrostic costs

With an acrostic, each word is no longer drawn from the whole pool — it is drawn from the words beginning with the letter you specified. So the formula becomes a sum rather than a product: the total is log2 of the pool for the first letter, plus log2 of the pool for the second, and so on.

The letters are very unevenly distributed. In the EFF long list, restricted to five-to-nine-letter words, the pool beginning with s is several times larger than the pool beginning with j, and much larger than the pool beginning with x. A six-letter acrostic therefore gives a figure somewhere below six times the unconstrained per-word value, and how far below depends entirely on which letters you chose.

The page does this sum for the exact letters you type, which is the only way to give an honest number. If one of your letters has no word behind it in the current list and length range, it says which letter rather than failing quietly.

The acrostic is also not secret. Assume an attacker knows the initials spell your dog’s name, because that is the kind of thing that gets guessed.

Turning bits into time, honestly

The time estimates on this page assume an offline attack at one trillion guesses a second against a stolen password database, and that half the possibilities must be tried before the right one comes up. Those assumptions are stated wherever a time appears, because a time estimate without them is meaningless.

One trillion guesses a second is a deliberately harsh figure. It is in the right region for dedicated hardware attacking a fast, badly chosen hash function. A site using a modern password hash properly is slower to attack by a factor of millions, and any online login form is slower still by a factor of billions, since every attempt is a network request the server can rate-limit.

That is why the numbers on this page are pessimistic on purpose. If the estimate says a search would take far longer than anybody has, the real figure against a competently run service is longer still.

Why a website’s strength meter says something different

Most strength meters score the characters in front of them, because that is all they have: they never see how the password was generated. They reward mixed character classes, punish repetition, and often match against dictionaries of common passwords. Against a human-invented password that is a reasonable heuristic, and it is the only thing a form can do.

It scores a generated passphrase badly for exactly the wrong reason. Six lowercase dictionary words with spaces between them look, to a character-counting heuristic, like precisely the thing it is built to warn about — even though the words were drawn at random and the result is stronger than almost anything the meter would applaud.

When a meter and this page disagree about a passphrase generated here, the page is describing the process and the meter is describing the appearance. Neither is lying; they are measuring different things, and only one of them knows where the words came from.

What happens to what you generate

ToolAcre generates passwords locally in your browser. For highly sensitive environments, verify your browser, device and operating system are trusted before using any web-based password generator.

• Every passphrase and password is generated in your browser tab, by your browser’s own cryptographic random number generator. No server is involved once the page has loaded.
• Nothing generated here is sent to ToolAcre. This product’s Content-Security-Policy restricts the page to its own origin, so the browser itself blocks any attempt to send data elsewhere.
• Nothing is written to local storage, session storage, a cookie, an in-browser database, the address bar or the browser console. Reloading discards it; closing the tab discards it.
• There is no account, no sign-in, no analytics script and no advertising script. The only files downloaded are the static word lists.
• No history is kept. Generating again replaces the value, and the previous one is not recoverable.

Questions

Limitations

• Entropy is an upper bound on the difficulty of guessing, not a prediction of how an account will actually be compromised. Most accounts are lost to phishing, reuse and breached databases rather than to guessing.
• The figures assume the random source is sound. This page uses the browser’s cryptographic generator and refuses to run without it, but it cannot audit that generator from inside the page.
• Time estimates depend entirely on an assumed guessing rate. The rate used here is stated, deliberately harsh, and may be wrong in either direction for any particular attacker.
• The calculation assumes each word is drawn independently and uniformly. It would overstate strength if that were not true, which is why the generator draws with replacement rather than removing words it has already used.
• No entropy figure accounts for a passphrase being reused, written somewhere insecure, or typed on a compromised machine.