Password Entropy Calculator
Calculate password entropy in bits from character set size and password length.
About Password Entropy Calculator
Password entropy measures how many bits of uncertainty an attacker faces when brute-forcing a password, calculated as the password length multiplied by the base-2 logarithm of the character set size — each additional character multiplies the total number of possible passwords by the charset size, so entropy grows linearly with length but the actual search space grows exponentially. A password drawing from all four common character classes (26 lowercase + 26 uppercase + 10 digits + 32 special characters = 94 possible characters per position) reaches meaningfully higher entropy per character than one restricted to lowercase letters alone, which is why both length and character diversity matter for resistance to brute-force attacks.
Formula
Password entropy
entropy_bits = length × log2(charset_size)
- L
- password length in characters
- C
- size of the character set used
Worked example
With the default values below, Password Entropy Calculator returns Entropy of 104.9. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Password Lengthminimum 1 characters
- 16 characters
- Include Lowercase (a-z)
- Yes
- Include Uppercase (A-Z)
- Yes
- Include Digits (0-9)
- Yes
- Include Special Characters (32 symbols)
- Yes
Results
- Entropy
- 104.9 bits
- Strength Rating
- Strong
- Character Set Size
- 94
- Total Possible Combinations
- 3.72e+31
- Estimated Brute-Force Time (at 10B guesses/sec)
- 1.18e+14
Step by step
- 1Values used
- 2Password entropy
- 3Entropy= 104.9 bits
- 4Strength Rating= Strong
- 5Character Set Size= 94
- 6Total Possible Combinations= 3.72e+31
- 7Estimated Brute-Force Time (at 10B guesses/sec)= 1.18e+14
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
Is a longer password with fewer character types better than a shorter one with more types?
Usually yes — entropy grows linearly with length but only logarithmically with charset size, so adding characters to a password (increasing L) generally buys more entropy than adding another character class to a short password. A 20-character lowercase-only password (94 bits) beats a 10-character password using all four classes (66 bits).
Does this entropy calculation apply to randomly generated passwords only?
Yes — this formula assumes each character is chosen independently and uniformly at random from the specified character set. Human-chosen passwords (even long ones) are far less random due to predictable patterns like dictionary words, dates, and keyboard walks, so their true entropy is much lower than this formula would suggest.
What entropy is considered secure today?
NIST and most security guidance consider 60+ bits reasonable for typical accounts, 80+ bits strong for sensitive systems, and 128 bits effectively immune to brute force for the foreseeable future given current and projected computing power — password managers generating long random strings comfortably clear these bars.