Password Entropy Calculator

Password entropy is a measure of how hard a password is to guess, expressed in bits. One extra bit means an attacker has to double the number of guesses. The formula is short: entropy in bits equals the password length multiplied by the base-two logarithm of the size of the character pool you drew from. A pool of just lowercase letters has 26 symbols, adding capitals takes it to 52, adding digits to 62, and a full keyboard with symbols sits around 95. Longer passwords and bigger pools both raise the count, but length is the stronger lever, because it multiplies while the pool only sits inside a logarithm.

Here is the catch that the math cannot see. The formula assumes every character was chosen at random and independently. A genuinely random 12-character string really does carry the bits this tool reports. The word Password1! does not, even though it ticks the length and symbol boxes, because attackers run dictionaries and common substitutions first. Treat the entropy here as the strength of a randomly generated password of that shape, which is the ceiling, not the strength of a word you thought up.

What do the bits mean in practice? Each scenario below assumes a different guessing speed, from a throttled login form at a hundred tries a second up to a cracking rig hammering a stolen hash billions of times a second. The time shown is the average, half the search space, which is what you would expect on a typical crack rather than the unlucky worst case.

As a rough guide, under about 28 bits is trivial, 60 bits resists casual offline attacks, and 80 or more is comfortable for anything that matters. The simplest way to climb the scale is to add length. Enter a length and pick a character pool to see the entropy, the total number of combinations, and how long each kind of attacker would take.