Password strength is much easier to reason about in bits than in vague labels. This password entropy calculator works out how many combinations your password contains, converts that into bits of entropy and estimates how long an attacker would need to crack it at different guessing rates.
What Is the Password Entropy Calculator?
Entropy measures password strength in bits, where every extra bit doubles the number of possible passwords an attacker has to try. A password with 60 bits of entropy takes about a billion billion attempts at a billion guesses per second, which is why length matters more than symbol soup.
This calculator works out the size of your character set, multiplies it out across your password length and converts the total into bits. It then estimates the crack time at the rate you choose and at a thousand times that rate.
How Entropy Is Calculated
Entropy in bits = Length × log2(size of the character set)
The character set is the count of every character the password could contain. A password using all 94 printable ASCII characters gives about 6.55 bits per character, while one using only 26 lower case letters gives 4.7 bits. Mixing in upper case, digits and symbols lifts the set to 94 and adds nearly two bits per character for free.
The crack time assumes the attacker guesses optimally, which is the best case for them. The estimate is for a random password of that length, and it falls apart entirely for a password that follows a predictable pattern.
Length Beats Complexity
Adding one character to a password is worth more than adding a symbol. Going from 11 to 12 characters adds roughly 6.5 bits at full ASCII, which doubles the work an attacker has to do. Replacing every letter with a symbol instead adds less than one bit.
The practical version of this is that a long passphrase of ordinary words is stronger than a short string of punctuation, and it is also far easier to remember and to type accurately.
What This Calculator Cannot Know
Entropy assumes every character is chosen independently and uniformly at random. A real password that follows the alphabet, contains the word password or reuses the same digits does not have that entropy, and crackers exploit exactly those patterns first.
It also does not factor in dictionary attacks, rules based on the name of the service or the birth year of the person behind the account. Those attacks are far faster than brute force and they are what most real breaches rely on.
Frequently Asked Questions
What is a good bit value for a password?
60 bits gives a reasonable margin against offline cracking, 80 bits is strong and 100 bits or more is beyond guessing even with a large botnet. For most personal accounts, a long passphrase reaches 60 bits comfortably.
Does adding a symbol make a password much stronger?
Less than adding a character. Going from 26 lower case letters to the full 94 printable characters raises the bits per character from 4.7 to 6.55, so it is worth roughly one extra character of length.
How long would a 12 character password take to crack?
With the full character set of 94 characters, 12 characters gives about 78.6 bits. At ten billion guesses per second that is roughly 200 years of continuous guessing, and a thousand times faster attacker would need about 74 days.
Is a long passphrase really stronger than a short complex one?
Yes, and it is also easier to remember. Five random words give around 65 bits, which is stronger than eight characters of mixed case and symbols, and you will not forget it.
Why do password managers recommend long random strings?
Because they generate characters uniformly at random, which is exactly the assumption the entropy figure depends on. A human-chosen password with the same length usually has far less real entropy than the number suggests.