Minimum Password Length Calculator

length = ceiling(target bits ÷ log2(charset size)); for a time target, bits needed = log2(2 × rate × years × 31,536,000). Each character contributes log2(charset) bits, so dividing the target by that and rounding up gives the shortest compliant password. The time-based route works backwards from the attack: surviving Y years at R guesses per second means the keyspace must exceed 2 × R × Y × seconds-per-year, and taking log2 converts that keyspace into bits.

It replaces the arbitrary '8 characters minimum' with a number derived from the hash you actually use — against bcrypt a 10-character password is fine, against unsalted MD5 it is not.

This calculator takes 4 inputs: Target entropy, Character set available, Attacker's hash rate, Years the password must survive. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because a slow hash does the work for you. Against Argon2id at 5000 guesses per second, surviving a century needs only about 45 bits — 7 characters. The entropy target then dominates, which is the right outcome: it protects you if the hash is ever downgraded or the attacker's hardware improves.

Yes. GPU cracking throughput has historically risen roughly an order of magnitude per decade, which is about 3.3 bits. Adding 10 bits to the target covers roughly 30 years of hardware progress; one extra character of printable ASCII buys 6.6 of them.