Password Complexity Calculator

combinations = charset size ^ minimum length, and the policy's entropy floor = minimum length × log2(charset size). A composition policy sets a floor, not a typical value: the weakest password it permits is one of minimum length drawn from the allowed characters. Allowing symbols lifts the charset from 62 to 95, worth 0.62 bits per character, while each extra required character is worth a full log2(charset) bits.

Policies are usually argued about in terms of rules; converting them into an entropy floor shows which rules buy real strength and which only annoy users.

This calculator takes 6 inputs: Minimum length required, Lowercase allowed, Uppercase allowed, Digits allowed, Symbols allowed, Classes the policy forces. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

SP 800-63B found that mandatory class rules push users toward predictable patterns — a capital at the front, a digit and an exclamation mark at the end — which mangled wordlists model directly. The guidance keeps the length minimum and the breach-list check, and drops the class requirements.

Slightly, in theory: requiring at least one of each class removes some passwords from the keyspace. The effect is a fraction of a bit. The real cost is behavioural, not mathematical.