Password Entropy Calculator
A password strength calculator based on entropy. Type a password (analyzed only in your browser) to see the character pool it draws from, its entropy in bits, a strength rating, and an estimated time to crack at realistic offline attack speeds. Explains why length beats complexity and where the entropy model’s limits are.
Time to crack (offline, fast hash @ 1010/s): about 8,561 centurys
This is the theoretical maximum for the character set, assuming every character is random. Real, memorable passwords use words and patterns attackers guess first, so practical strength is lower — the fix is genuine randomness (a password manager or random passphrase).
Password strength is really one question: how many guesses would an attacker need? Entropy answers it in bits. If each character is chosen at random from a pool of P symbols and the password is L long, there are P^L possibilities, and the entropy is L × log2(P) bits. Every extra bit doubles the search space — so this is a logarithmic scale where small-sounding differences are enormous.
That math explains the single most useful rule: length beats complexity. Widening the character pool only nudges the per-character bits (lowercase is ~4.7 bits/char, full ASCII ~6.6), but every character you add contributes another whole chunk of those bits. A four-word random passphrase quietly out-classes a gnarly eight-character password stuffed with symbols, and it is easier to type. The crack-time estimate here turns bits into a feel — but read it as an order of magnitude: it assumes a fast offline attack, and a proper slow hash like Argon2 buys thousands of times more time.
The honest caveat is baked into the word random. This tool reports the theoretical entropy of the character set, but humans pick words, dates and P@ssw0rd-style patterns that attackers guess first, so a real memorable password is weaker than its bit count suggests. The only way to actually get the entropy the number promises is genuine randomness — which in practice means a password manager. And your input never leaves this page; the analysis is entirely local.
How it works
- Detects the character pool your password draws from.
- Entropy = length × log2(pool size), shown in bits.
- Estimates crack time at a realistic offline attack rate.
- Analyzed entirely in your browser — never transmitted.
Frequently asked questions
What is password entropy?
Entropy measures how unpredictable a password is, in bits. If a password is drawn randomly from a pool of P possible symbols and is L characters long, its entropy is L × log2(P) bits. Each extra bit doubles the number of guesses an attacker must make, so a 60-bit password is roughly a billion times harder to brute-force than a 30-bit one. It is the cleanest single number for comparing password strength — with the big caveat that it assumes the characters are actually random.
Why does length matter more than adding symbols?
Because length multiplies entropy while pool size only adds to the base of a logarithm. Growing the character pool from 26 to 95 symbols raises per-character entropy from about 4.7 to 6.6 bits — a modest gain. Adding characters, by contrast, multiplies: each extra character adds another full 4.7–6.6 bits. That is why a long lowercase passphrase usually beats a short password full of symbols, and why modern guidance favors length.
How realistic is the "time to crack"?
It is an order-of-magnitude estimate, not a guarantee. It assumes an offline attacker who has the password hashes and guesses at a fixed rate — this tool uses a fast-hash figure (around 10 billion guesses/second for a GPU rig against a weak hash like unsalted MD5/SHA-1). Against a proper slow hash (bcrypt, scrypt, Argon2) the rate is thousands of times lower, so the same password lasts far longer; against an online login with rate limiting, slower still. Treat the number as a comparison tool, not a countdown.
Why is my real password weaker than the bits suggest?
Because the entropy formula assumes every character is chosen uniformly at random, and human-chosen passwords are not — they use dictionary words, names, dates, keyboard patterns and predictable substitutions (P@ssw0rd). Attackers exploit exactly that with wordlist and rule-based attacks, so a "70-bit" password built from two common words falls far faster than 70 bits implies. The calculator shows the theoretical maximum for the character set; the practical strength of a memorable password is lower. The fix is genuine randomness — a password manager or a random passphrase.