Password Entropy Calculator

About this tool

The Password Entropy Calculator computes the theoretical entropy of a password in bits from its length and the character classes it uses. Higher entropy means more possible passwords and therefore exponentially harder brute-force attacks. The tool checks for lowercase letters (26), uppercase letters (26), digits (10) and any other character (counted as 32 symbols, including spaces and non-Latin characters), adds up the charset size, and computes entropy as log2(charset^length). As you type it shows a strength bar and label (Very Weak under 28 bits, Weak under 36, Fair under 60, Strong under 120, Very Strong from 120), the length, charset size and entropy, and the time to try every combination at 1 billion (Crack @1B/s) and 1 trillion (Crack @1T/s) guesses per second. The math assumes every character was chosen at random; it does not detect dictionary words, keyboard patterns or substitutions, so real passwords are often far weaker than the number shown.

Why use it

• Shows entropy in bits, an attack-speed-independent way to compare randomly generated passwords.

• Estimates exhaustive cracking time at 1 billion and 1 trillion guesses per second.

• Shows the charset size so you can see how much each character class adds.

• All computation is local — your password never leaves your browser.

• Helps your team align on a numeric entropy target for generated passwords rather than vague rules like must contain a symbol.

How to use

1. Type or paste a password into the Password field (it is never stored or transmitted). Click Show to see what you typed.
2. Read the strength bar, the strength label and the entropy in bits as you type.
3. Check Length, Charset size and Entropy (bits) in the result cards.
4. Compare Crack @1B/s and Crack @1T/s to see how long trying every combination would take at those speeds.
5. Add or remove a character class or a few characters and watch the entropy change live to learn which choices matter most.

When it helps

• Evaluating whether a randomly generated password meets a target entropy level (e.g. 128 bits).
• Teaching users about the relationship between password length, charset, and security.
• Comparing the strength of different password policies.
• Debugging password strength requirements in security applications.
• Designing or reviewing password policies; entropy thresholds are far more defensible than ad-hoc complexity rules.

Examples

1234

Very Weak • 13.3 bits • charset: 10. Length 4, Crack @1B/s: < 1ms, Crack @1T/s: < 1ms.

Pa55word

Fair • 47.6 bits • charset: 62. Crack @1B/s: 3 days, Crack @1T/s: 3.6min. No pattern warning is shown, although the real-world strength is far lower.

kT9!fZ2qLm@8nVbX

Strong • 104.9 bits • charset: 94. Crack @1B/s: Centuries, Crack @1T/s: Centuries.

password

Fair • 37.6 bits • charset: 26. Crack @1B/s: 3.5min, Crack @1T/s: 209ms.

Tips

• Aim for 80+ bits of entropy for everyday accounts and 128+ bits for credentials guarding sensitive data; 64 bits and below is considered weak in 2026.
• Length almost always beats character-set complexity. Adding one extra random character to a 64-symbol alphabet adds about 6 bits, while adding all symbols to a 6-character password adds only ~6 bits total.
• If you use a passphrase of 4-6 random words, you get roughly 13 bits per word from a 7,776-word dictionary (Diceware) — six words yields about 78 bits, decent for general use.
• This calculator assumes random characters. Anything based on real words, dates, or keyboard walks has dramatically lower effective entropy than the math says.
• Pair entropy targets with rate-limiting. A 60-bit entropy is fine if the attacker is throttled to 10 attempts per second, but trivial if the password file leaks and offline cracking is possible.
• For password policies, do not require character classes (uppercase, digit, symbol). They reduce the effective alphabet (because users predictably substitute) and frustrate users into writing them down.
• Re-evaluate entropy targets every few years; GPU password cracking gets faster, so a 100-bit password considered safe today might be weaker against 2030 hardware.

Frequently Asked Questions

Glossary

Entropy

The information-theoretic randomness of a password, measured in bits. N bits of entropy means 2^N possible passwords.

Bits of entropy

The unit used to compare passwords. Each extra bit doubles the search space and therefore the brute-force time.

Alphabet / character pool

The set of distinct characters from which a password is drawn. Bigger pools yield more entropy per character.

Brute force

Trying every possible password until one works. Cost grows exponentially with entropy and can be parallelized across many GPUs.

Online attack

Password guessing against a live login endpoint. Limited by rate-limiting, lockouts, and network round-trip time, typically 10-1000 guesses/second.

Offline attack

Password guessing against a leaked hash. Limited only by hardware speed and the slowness of the hash function. GPUs can attempt 10^10 to 10^14 hashes/sec depending on algorithm.

Diceware

A passphrase generation method that picks random words from a 7,776-word list using physical dice. Each word contributes about 12.9 bits of entropy.

NIST SP 800-63B

U.S. standard guidelines for digital identity. Recommends discontinuing arbitrary complexity rules in favor of length and breach-list checks.