Password Entropy Explained: Bits, Bias and How Cracking Really Works : Free Offline Strong Password Generator

Password Entropy, Explained Properly

Almost everything people believe about strong passwords is half true. Symbols help less than length, a familiar meter can be badly wrong, and the random number source matters more than the characters it picks. Here is what entropy actually measures and how cracking really works.

Last updated: July 2026

🔴 Entropy is a count of possibilities, measured in bits

The strength of a password is not a feeling, it is a number. That number is entropy, and it answers one question: how many equally likely passwords could this have been? If an attacker must search through a million possibilities, the password carries about twenty bits of entropy, because two to the twentieth power is roughly a million. Each extra bit doubles the search. The formula for a randomly generated password is simple, length multiplied by the base-two logarithm of the number of possible characters at each position. Twenty characters chosen from a pool of ninety-four gives close to a hundred and thirty bits.

The word randomly is doing heavy lifting there, and it is the part people miss. Entropy measures unpredictability, not appearance. The password Tr0ub4dor&3 looks complex but, because a human chose it by tweaking a dictionary word in predictable ways, its real entropy is far lower than its length suggests. Meanwhile a string of random lowercase letters looks tame yet can be enormously strong. Any honest strength meter has to estimate unpredictability, which is why the good ones report a bit count and the weak ones just admire the mix of character types. The broader concept is covered well on Wikipedia’s password strength page.

🟡 The random source is the whole game

OPEN TOOL NOW

A generator is only as unpredictable as the numbers feeding it, and this is where many tools quietly fail. The ordinary random function built into a programming language, the one most tutorials reach for, is a pseudo-random generator designed for speed and statistical smoothness, not secrecy. Its internal state can often be reconstructed from a handful of outputs, which means an attacker who knows the tool can predict the rest. For anything protecting an account you need a cryptographically secure generator, exposed in browsers as crypto.getRandomValues, whose output cannot be run backwards to recover its state.

There is a second, subtler flaw that even well-meaning tools stumble into: modulo bias. To pick one of ninety-four characters you take a large random number and use the remainder after dividing by ninety-four. But the range of the random number is rarely an exact multiple of ninety-four, so the first few characters end up very slightly more likely than the rest. Across a whole password the skew is small, yet it is a free gift to an attacker and it is entirely avoidable. The fix is rejection sampling: throw away the small tail of values that would cause the imbalance and draw again, so every character is exactly equally likely. A tool that gets the source right but the mapping wrong is still leaking a little entropy on every character.

🟢 And the shuffle that pretends to be one

A third classic mistake appears when a tool guarantees “at least one of each type” by placing those characters first and then shuffling. Sorting an array with a random comparison is not a shuffle; it produces a badly uneven distribution, so the guaranteed characters cluster in predictable positions. The only correct method is the Fisher-Yates shuffle, which walks the array once and swaps each element with a randomly chosen earlier one, giving every possible ordering an equal chance. Get any of these three things wrong, the source, the mapping or the shuffle, and the password is weaker than its bit count claims.

🟢 How cracking actually works

Attackers do not sit at a login form typing guesses. When a site is breached, what usually leaks is a file of hashed passwords, and the attack happens offline on the attacker’s own hardware at enormous speed. This is why how a site stores passwords matters as much as how you choose them. A fast hash like an unsalted MD5 can be tried billions of times a second on a rack of graphics cards. A slow, salted hash designed for the job, such as bcrypt, deliberately caps the rate to a few tens of thousands per second, and that difference alone can turn a crackable password into a safe one.

Crucially, offline cracking never starts with brute force. It starts with wordlists of leaked passwords, then applies rules: capitalise the first letter, append a year, swap letters for look-alike symbols, stack two words together. This is why P@ssw0rd2024! falls in seconds despite using four character types. Every transformation in it is a standard rule. Real entropy is only earned by choices the rules cannot anticipate, which is exactly what a pattern-aware auditor tries to estimate when it subtracts for dictionary bases, keyboard walks and dates. A useful way to think about a password’s life on the server side is covered in our companion piece on how secure hashing works.

🔴 Why length beats complexity, and why passphrases win

Add one character to a password and you multiply the search space by the size of the pool. Add one requirement, like forcing a symbol, and you barely move the number while making the password harder to remember and more likely to be written down. This is the maths behind a shift you may have noticed in official advice. Modern guidance, including the NIST digital identity guidelines, now discourages mandatory complexity rules and periodic forced changes, because both push people toward predictable patterns, and instead encourages long passphrases and screening against known-breached passwords.

A passphrase is the practical expression of “length beats complexity”. Choose several words at random from a known list and the entropy is again countable: the number of words multiplied by the base-two logarithm of the list size. The widely used EFF word list has 7776 entries, which works out to almost thirteen bits per word, so a five-word passphrase clears sixty bits while remaining something you can actually say. The method was popularised as Diceware, and the EFF’s own explainer on Diceware passphrases walks through it. The vital caveat is that the words must be chosen by the generator, not by you. A phrase you invent from a favourite song is memorable precisely because it is predictable, which is the opposite of what you want.

🟡 Where the maths meets everyday habits

All of this theory points at a small number of habits. Let a cryptographic generator choose your passwords or passphrases, so unpredictability is guaranteed rather than hoped for. Favour length over decoration, because bits come from length far more cheaply than from symbols. Use a different secret for every site, since the greatest real-world risk is not a password being cracked but one being reused across accounts, so a single breach unlocks many doors. And keep those unique secrets in a password manager, because the human memory that made passphrases attractive cannot hold fifty of them.

The reason to prefer a tool that runs entirely in your browser follows from the same logic. A password is a secret, and a secret sent to a server to be generated or checked is a secret that has left your control, however trustworthy the server. Local generation using the browser’s own cryptographic primitives keeps the secret on your machine from the first character to the last. You can see every idea in this article play out in the Password Studio, which generates with a real cryptographic source, reports genuine entropy in bits, and audits existing passwords for the very patterns crackers exploit, all without a single byte leaving your device.