Password Entropy Calculator
Measure password strength in bits of entropy and estimate crack time.
Please note: Reference calculations for development and study. Verify security-relevant figures — entropy, collision probability, crack times — against current guidance before relying on them, since attacker capability changes over time.
What the Password Entropy Calculator does
Entropy measures how many guesses an attacker must make, expressed as bits — each bit doubles the search space. It depends only on the alphabet size and the length, and assumes every symbol was chosen at random, which is exactly where human-chosen passwords fall down.
Formula
Entropy = Length × log₂(Alphabet size)Combinations = Alphabet^Length = 2^EntropyAverage guesses = 2^(Entropy − 1)Crack time = Average guesses ÷ Guess rate
Inputs explained
| Input | Unit | Required | Notes |
|---|---|---|---|
| Password length | number | Yes | Number of characters, or words for a passphrase. Accepts 1 or more. |
| Character set | one of 6 options | Yes | — |
| Custom alphabet size | number | Optional | Overrides the choice above if set. Accepts 2 or more. |
| Attacker capability | one of 4 options | Yes | — |
How to use it
- Choose Character set and Attacker capability.
- Enter Password length.
- Optionally add Custom alphabet size.
- Select Calculate.
Worked example
A 12-character random password from all 95 printable ASCII characters, against a GPU cracking rig.
- Length
- 12
- Charset
- Printable ASCII
- Rate
- 10¹² guesses/sec
log₂(95) = 6.57 bits per character, so 78.84 bits total — about 5.4 × 10²³ combinations. At 10¹² guesses a second it takes roughly 8,600 years on average.
Frequently asked questions
How many bits of entropy is enough?
60 bits resists casual offline attack, 80 is a solid target, and 128 is beyond any foreseeable brute force. Below 40 bits offers essentially no protection against an offline attacker.
Are passphrases better than complex passwords?
Usually, because length wins and they are memorable. Six Diceware words give 77.5 bits — stronger than a typical 10-character mixed password, and far easier to recall.
Does this reflect my actual password?
Only if it was randomly generated. A human-chosen password with substitutions like "P@ssw0rd1" has a small fraction of the entropy its length implies.