Password Entropy Calculator
Bits of security, not vibes.
Password Entropy Calculator
Estimate the search space of a randomly generated password and how long an offline attacker would need.
Length matters more than complexity: every extra character multiplies the search space.
This measures entropy, not whether a password is guessable. Human-chosen patterns, reused passwords, and dictionary words collapse the real search space far below the number shown.
104.9bits
Very strong
- Character pool
- 94
- Possible combinations
- 10^31.6
- Crack time (10¹² guesses/s)
- 588,679,167,988 years
Assumes a random password and a fast offline attack against a poorly stored hash. Rate-limited online logins are far slower, and a breached hash is often cracked much faster than the arithmetic suggests.
Embed this calculator
Put this calculator on your own site with the snippet below. The frame contains the tool only, reports its own height, and carries a visible link back to the full page. Embedding is free; keep the attribution link as it is, and do not wrap the frame in a way that hides it.
Preparing the embed code for this page...
What This Calculator Does
The Password Entropy Calculator estimates the size of a password’s search space in bits and converts it into an offline cracking time. It is a planning tool for password policy, not a check on a specific secret — nothing you type is stored or sent anywhere.
How It Works
Entropy is the password length multiplied by the base-2 logarithm of the character pool. An eight-character password drawn from 26 lowercase letters has about 37.6 bits; the same length from 94 printable characters has about 52.4 bits. Crack time divides half the keyspace by a guess rate, here one trillion guesses per second.
Example
A random 16-character password using all four character sets has a pool of 94 and about 105 bits of entropy. At a trillion guesses per second, the expected time is astronomically long. An 8-character lowercase-only password has 37.6 bits and falls in a fraction of a second.
Formula
Bits = length × log₂(pool size)Seconds ≈ 2^(bits − 1) / guesses per secondReading the Results
Entropy in bits
The base-2 log of the number of equally likely passwords. Each extra bit doubles the work an attacker must do.
Crack time
An expected time at a stated guess rate, assuming the password was randomly generated. Human patterns make the real search much smaller.
Sources and References
NIST SP 800-63B — Digital Identity Guidelines
Entropy, length, and rate limiting
Recommends length and blocklist checks over forced composition rules, and rate-limited verification.
OWASP — Password Storage Cheat Sheet
Fast hashes fall quickly to offline attack
Explains why a leaked unsalted fast hash can be attacked at enormous rates.
References identify the method or data behind this calculator. Where a standard or tariff changes, the current edition applies, and the assumptions stated above take precedence over a remembered figure.
Frequently Asked Questions
What is a good entropy target?
NIST and common practice suggest aiming well above 60 bits for user-chosen passwords and 80 or more for high-value accounts. Randomly generated passwords of 16 characters or more comfortably exceed both.
Is length really more important than symbols?
Yes. Adding one character multiplies the keyspace by the pool size, while adding a symbol set enlarges the pool more modestly. A long passphrase of ordinary words beats a short string of substitutions.
Does this check whether my password has been breached?
No, and it cannot. It measures the size of the search space, not whether a specific password appears in a leaked list. Check your password against a breach service and never reuse one across sites.
Why do you assume a trillion guesses per second?
That is roughly the rate of a modern GPU rig against a fast, unsalted hash. Rate-limited online logins are far slower, while a poorly stored hash can be attacked faster. The number is a scenario, not a guarantee.