How password strength is really measured

Most people judge passwords by how complicated they look. Security experts judge them by entropy — how many guesses an attacker needs. Here's how it works.

Entropy: the real metric

Entropy measures uncertainty in bits. A coin flip has 1 bit; a random character chosen from 94 symbols has about 6.5 bits. Every bit of entropy doubles the guesses required, so a 16-character random password has roughly 100 bits — trillions of trillions of possibilities.

Why patterns fail

'Password1!' looks complex but follows known patterns — dictionaries, keyboard walks (qwerty), and common substitutions (a→@) are exactly what cracking tools check first. Predictability destroys entropy faster than any symbol requirement.

Crack time, explained

An offline attacker can test billions of guesses per second on leaked hashes. That's why our password strength tester estimates crack time: if your password falls in seconds or minutes, it's effectively unprotected.

The fix

Length + true randomness beats cleverness. Use our random password generator for 16–20 random characters, store them in a password manager, and let strength come from entropy — not from tricks.