What is password entropy and how to calculate it mathematically?

Password entropy is a measure of its unpredictability and randomness, measured in bits. From an information security standpoint, it shows the complexity of cracking a combination by brute force. The higher the entropy indicator, the more time and computational resources an attacker will need to compromise the account.

To calculate entropy, a logarithmic formula is used that takes into account the alphabet size and the total password length. Alphabet size means the number of possible characters that can be used. For example, only lowercase Latin letters give an alphabet of 26 characters, and adding uppercase letters, numbers, and special characters increases this value to 94 and more.

To calculate entropy, one must take the base-2 logarithm of the alphabet size and multiply the resulting number by the total password length in characters. The resulting value reflects the amount of bits of information embedded in the combination. Each additional bit of entropy doubles the cracking complexity for a computer, which makes long passwords exponentially more reliable than short ones.

In practice, users often create passwords that seem complex to them but have low actual entropy due to the use of dictionary words or predictable character substitutions. Cybercriminals take the human factor into account and use optimized dictionaries instead of blindly brute-forcing all possible combinations. Therefore, the mathematical calculation of entropy must correlate with the password's resistance to dictionary attacks.

To create secure combinations with high entropy, it is recommended to use random password generators or phrase constructions. A long passphrase consisting of four random, unrelated words often possesses greater entropy and is better remembered by a person than a short set of random characters with complex punctuation marks.