Password Entropy Calculator
Measure password strength in bits of entropy and estimate crack times.
About this tool
Understand exactly how strong your password really is. Paste or type a password (masked by default, with a show/hide toggle) and the calculator measures its entropy in bits based on the character set used — lowercase, uppercase, digits, symbols. It then estimates crack time across three threat models: online throttled attack (100 guesses/second), offline fast attack (10 billion/second), and GPU cluster (100 trillion/second). A visual strength meter and actionable suggestions help you improve weak passwords. An inline explainer answers 'Why is length more important than complexity?'
How to use
- 1 Type or paste your password in the input field.
- 2 Use the eye icon to toggle visibility.
- 3 Read your entropy in bits and the strength rating.
- 4 Check the crack-time table for different attack scenarios.
- 5 Follow the improvement suggestions to make your password stronger.
What entropy measures and how this tool computes it
Password "strength" is really a question of how many guesses an attacker would need before stumbling onto yours. Entropy puts a number on that. It is measured in bits, and each additional bit doubles the number of possibilities an attacker must work through. This calculator uses the standard formula entropy = length × log₂(charset size), where the charset size is the number of distinct characters your password could theoretically be drawn from. Everything runs in your browser — the password you type is analyzed locally and never transmitted, which you can confirm by disconnecting from the network and watching it still work.
The charset size is inferred from which character classes appear in your password, and it is purely additive:
| Character class present | Adds to charset |
|---|---|
| Lowercase a–z | +26 |
| Uppercase A–Z | +26 |
| Digits 0–9 | +10 |
| Symbols | +32 |
| Non-ASCII / Unicode | +64 (rough bonus) |
So a password using lowercase, uppercase, and digits draws from a pool of 26 + 26 + 10 = 62 characters, giving about 5.95 bits per character. A 12-character password from that pool carries roughly 71 bits of entropy.
A worked example
Type Tr0ub4dor. It is 9 characters and mixes lowercase, uppercase, and digits, so the charset is 62 and entropy is 9 × log₂(62) ≈ 53.6 bits — landing in the "Good" band. Now add three more characters to make it Tr0ub4dor&Co: introducing a symbol bumps the charset to 94, and the length rises to 12, pushing entropy to about 78.6 bits — nearly into "Very Strong." Notice that the bigger jump came from the three extra characters, not the single symbol. That is the central lesson the tool's built-in explainer drives home: length compounds, complexity only nudges.
Reading the crack-time table
From the entropy the tool computes the total number of combinations (2 raised to the entropy) and divides by three attacker speeds to estimate how long an exhaustive search would take:
| Threat model | Guesses/second | Represents |
|---|---|---|
| Online throttled | 100 | Guessing against a live login that rate-limits attempts |
| Offline fast | 10 billion | Cracking a leaked password hash on a single machine |
| GPU cluster | 100 trillion | A well-funded, nation-state-scale attack |
The same password can be "practically forever" online yet fall in days under a GPU cluster — which is exactly why a password that is merely "Fair" is risky if a database leak ever exposes its hash. Plan for the offline scenario, not the friendly online one.
Why these numbers are an upper bound, not a guarantee
Entropy as calculated here assumes your password is random within its character classes. Real passwords usually are not. If you typed a dictionary word, a name, a date, or a predictable pattern like Summer2024!, an attacker does not blindly try all combinations — they try the likely ones first and reach yours in a tiny fraction of the theoretical time. The tool flags some of these traps in its suggestions: it warns about repeated characters such as aaa and about common patterns like passwords starting with password, 123456, or qwerty. Treat the reported crack time as the best case — the time it would take only if your password is as random as its character set implies.
Practical tips
- Aim past 80 bits for anything important. That is the threshold for the "Very Strong" rating and keeps you comfortably ahead of offline attacks for the foreseeable future.
- Prefer length to symbol-stuffing. Going from 8 to 12 characters does far more than adding one
!. A long random passphrase is both stronger and easier to type. - Use the show/hide toggle privately. The eye icon reveals the password so you can check it — only do so when no one is looking over your shoulder.
- Heed the suggestions, but don't game them. Adding a symbol to satisfy the "add symbols" hint helps only if the password is also long and unpredictable.
Common mistakes
- Trusting a high score on a guessable word.
P@ssw0rd123scores respectably here because the formula counts character classes, but it is in every cracking dictionary. The number does not know your password is a cliché. - Reusing a strong password everywhere. Entropy protects against guessing, not against reuse. One leaked site exposes a reused password to every other account regardless of its bit count.
- Optimizing the online number. "Centuries" against a throttled login means nothing if the same password's hash is later stolen and attacked offline at 10 billion tries per second.
- Ignoring the upper-bound caveat. A 60-bit password built from a memorable phrase may have far less effective entropy than 60 bits because its structure is predictable.