"Strong password" is used a lot, but what does it actually mean? This guide explains it with no maths degree needed. It is part of our password basics series.
Strength means guesses
An attacker cannot read your password, so they have to guess it. The strength of a password is simply how many guesses they would need. Everything else follows from this.
Think of a combination lock. Three dials give 1,000 combinations, while six dials give a million. Adding a dial multiplies the work by ten.
What "entropy" means
Entropy is the word security people use for this. It measures how unpredictable something is, counted in bits. Each extra bit doubles the number of guesses.
| Bits | Roughly how many guesses | Example |
|---|---|---|
| 20 | 1 million | A six-digit PIN |
| 40 | 1 trillion | 8 random lowercase letters is about 38 |
| 52 | 4 quadrillion | 8 random characters, or 4 random words |
| 78 | 300 sextillion | 6 random words |
| 105 | 40 nonillion | 16 random characters |
How to work it out
For a random password, two things decide the strength: how many options each position has, and how many positions there are.
- 26 lowercase letters give 4.7 bits per character.
- All 94 keyboard characters give 6.6 bits per character.
- One word from a 7,776-word list gives 12.9 bits.
Multiply by the length, and you have the strength. This is why length beats complexity.
The catch: it has to be random
Those numbers assume that each choice was truly random. A human-chosen password has far less real entropy than its length suggests.
Summer2025! has 11 characters, so it looks like 72 bits. In reality, it is a season, a year and a symbol, and an attacker can try that pattern in moments. Read what makes a password weak.
That is why a generator matters. It removes the human patterns that attackers rely on.
What strength cannot do
A very strong password still fails if:
Strength handles guessing. Uniqueness and two-factor login handle the rest.