Here is a cartoon about password entropy. http://xkcd.com/936/

I dont quite understand how the entropy is calculated in the cartoon assuming they are calculate correctly. But in general, I dont have much idea about how password entropy is calculated.


1 Answer 1


First of all: Entropy is a property of the process generating a password, not a property of an individual password.

Random passwords

Apart from that, the basic idea is the following: Say you have the password aeLuboo0 that contains lower-case chars, upper-case chars and numbers. Then under the assumption that you have choosen every character uniformely from all possible characters, there are in total

$$(26 + 26 + 10)^8 = 218340105584896$$

many passwords that can be generated in the same way as your concrete password has been generated. The entropy in bits is now the number of bits you need to have approximately the same number of possible bit-combinations. That is:

$$\log_2((26 + 26 +10)^8) = 47.633570483095$$

Hence the assumed process that generated your password aeLuboo0 can generated as many different equal likely passwords, as different numbers can be represented by $47.63$ bits. The entropy of the password can be assumed to be at $48$ bits.

Non random passwords

The cartoon has the example of a word, that has been taken from a dictionary and then mutated to get the actual password. The idea of entropy is the same again (heavily simplified): Guess the number of different words your theoretical source dictionary and multiply it by the number of possible mutations the get a total count of passwords that can be generated in this way. Now find the $\log_2$ of this count to approximate the entropy.


Not the answer you're looking for? Browse other questions tagged or ask your own question.