Entropy Bit is the unit of a logarithmic measure of uncertainty. A uniform choice among 16 possibilities has 4 bits. Measures differ for nonuniform distributions; cryptographic min-entropy considers the most probable outcome. Encoding, key length and security strength are therefore not interchangeable.
For N equally likely possibilities, H = log2(N). Adding one independent fair bit doubles the possibilities; 16 equally probable values give 4 bits. This simple conversion requires uniformity. A list of possible values alone says nothing about their probabilities. [NIST SP 800-90B — Min-entropy and dependent samples] [RFC 4086 — Entropy measures and guessing]
Min-entropy follows Hmin = -log2(pmax). If one outcome has probability 3/4, the result is about 0.415 bits regardless of its encoding length. An attacker can guess it first. Shannon entropy measures average information; it is neither the same measure nor the exact average number of guesses. [NIST SP 800-90B — Min-entropy and dependent samples] [RFC 4086 — Entropy measures and guessing]
Repeating one random bit 256 times leaves only two possible complete strings: 1 bit of entropy. These are not 256 independent bits. NIST SP 800-90B distinguishes independent and dependent samples; a per-sample estimate cannot simply be multiplied across an arbitrarily dependent sequence without a model. [NIST SP 800-90B — Min-entropy and dependent samples]
Encoding the same secret as hexadecimal or words does not change its distribution. Nor can a hash turn known input into something unknown. A longer output cannot repair a small original input space; assessment must return to input acquisition and what an adversary could know. [NIST SP 800-90B — Min-entropy and dependent samples] [RFC 4086 — Entropy measures and guessing]
In BIP39, 12 words carry 128 input bits and 4 checksum bits, totaling 132 encoded bits. For 24 words the values are 256 and 8, totaling 264. Checksum bits are derived, not independent entropy. Hand-picked words may not even provide the quality those input lengths assume. [BIP39 — Input entropy and checksum lengths]
In a model of 128 independent fair secret bits, revealing 32 specified bits leaves 96 bits of uncertainty. This is a conditional calculation for that model, not a rule for every leak. Knowing the entire seed leaves no uncertainty about guessing it, even if originally generated well. [NIST SP 800-90B — Min-entropy and dependent samples] [RFC 4086 — Entropy measures and guessing]
NIST SP 800-57 distinguishes key length from security strength. Its classical comparison, for example, assigns 128-bit strength to ECC sizes from 256 to 383 bits. This does not certify a particular wallet or imply 256-bit security from length alone. Guessing input and cryptanalyzing an algorithm are different routes. [NIST SP 800-57 Part 1 Rev. 5 — Key length and security strength]
NIST SP 800-90B estimates entropy from a source, samples and assumptions, including dependencies and restarts. A bits claim needs a named measure and estimation conditions. A value from one file is no guarantee for every device and subsequent operation; min-entropy alone also does not determine exact attack time. [NIST SP 800-90B — Min-entropy and dependent samples]
For the clearest picture, read this entry together with Cryptographic Entropy, Brute Force Search Space, Seed Phrase, Private Key. The reverse links also lead from Dice Roll Entropy, Cryptographic Entropy, Brute Force Search Space.