Password Entropy Calculator
Calculate password entropy in bits from length and character set composition, and estimate brute-force resistance.
Inputs
Entropy
104.9bits
Strength Rating
Strong
Character Set Size
94
Total Possible Combinations
3.72e+31
Estimated Brute-Force Time (at 10B guesses/sec)
1.18e+14
Step by step
Values used
Password Length = 16 characters; Include Lowercase (a-z) = Yes; Include Uppercase (A-Z) = Yes; Include Digits (0-9) = Yes; Include Special Characters (32 symbols) = Yes
Password entropy
entropy_bits = length × log2(charset_size)
Entropy
= 104.9 bits
Strength Rating
= Strong
Character Set Size
= 94
Total Possible Combinations
= 3.72e+31
Estimated Brute-Force Time (at 10B guesses/sec)
= 1.18e+14
How it works
Password entropy measures how many bits of uncertainty an attacker faces when brute-forcing a password, calculated as the password length multiplied by the base-2 logarithm of the character set size — each additional character multiplies the total number of possible passwords by the charset size, so entropy grows linearly with length but the actual search space grows exponentially. A password drawing from all four common character classes (26 lowercase + 26 uppercase + 10 digits + 32 special characters = 94 possible characters per position) reaches meaningfully higher entropy per character than one restricted to lowercase letters alone, which is why both length and character diversity matter for resistance to brute-force attacks.
Formula
Password entropy
entropy_bits = length × log2(charset_size)
- L
- password length in characters
- C
- size of the character set used
Frequently Asked Questions
Is a longer password with fewer character types better than a shorter one with more types?
Usually yes — entropy grows linearly with length but only logarithmically with charset size, so adding characters to a password (increasing L) generally buys more entropy than adding another character class to a short password. A 20-character lowercase-only password (94 bits) beats a 10-character password using all four classes (66 bits).
Does this entropy calculation apply to randomly generated passwords only?
Yes — this formula assumes each character is chosen independently and uniformly at random from the specified character set. Human-chosen passwords (even long ones) are far less random due to predictable patterns like dictionary words, dates, and keyboard walks, so their true entropy is much lower than this formula would suggest.
What entropy is considered secure today?
NIST and most security guidance consider 60+ bits reasonable for typical accounts, 80+ bits strong for sensitive systems, and 128 bits effectively immune to brute force for the foreseeable future given current and projected computing power — password managers generating long random strings comfortably clear these bars.