What Is Password Entropy?

A plain-English explanation of password entropy, uncertainty, randomness and why one number never tells the whole story.

Entropy is a way of describing uncertainty

In password discussions, entropy is often used as a rough way to describe how many possibilities an attacker may need to consider. More uncertainty generally means a larger search problem.

Why length and randomness matter

If each character can be selected from a large set and the choices are genuinely unpredictable, adding characters can dramatically increase the number of possible combinations. That is why a random password generator can produce results that are much harder to predict than something designed around a familiar phrase.

Not all characters are equally surprising

A password can contain uppercase letters, digits and symbols yet still be predictable if it follows a common recipe. For example, replacing the letter a with @ does not magically make a familiar word random.

Entropy estimates have limits

A mathematical estimate cannot know everything about how a password was created. A truly random 12-character password and a 12-character password based on a public nickname may have the same length but very different real-world predictability.

Password entropy is not a guarantee

Even a theoretically strong password can be compromised through phishing, malware, password reuse or a vulnerable service. Entropy describes one part of the security picture, not every possible failure.