Guessing Entropy Glossary Definition

A guessing entropy is a measure of the difficulty that an Attacker has to guess the average password used in a system. In this document, entropy is stated in bits. When a password has n-bits of guessing entropy then an attacker has as much difficulty guessing the average password as in guessing an n-bit random quantity. The attacker is assumed to know the actual password frequency distribution.

In security and compliance work, this term helps teams describe controls, risks, identity practices, standards, audits, or protective technologies. It is relevant when managing access, reducing exposure, documenting safeguards, or demonstrating accountability.