Password Entropy
Calculate password entropy in bits based on length and character set.
About Password Entropy
Password entropy quantifies unpredictability in bits: entropy = length × log2(charset_size). Each character position contributes log2(charset_size) bits because that's how many bits are needed to represent one symbol chosen uniformly from the character set. A larger charset or greater length both increase entropy, but length has a compounding effect since it multiplies the per-character contribution. Crack time estimates assume a brute-force search over the full keyspace, averaging half the total combinations before a match is found, at a given guesses-per-second rate.
Formulas
Password entropy
entropy = length × log2(charset_size)
- L
- Password length in characters
- C
- Character set size (e.g. 26+26+10+32)
Average crack time
time = (charset_size^length / 2) / guesses_per_second
- r
- Attacker's guesses per second
Worked example
With the default values below, Password Entropy returns Entropy of 71.45. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Password Lengthaccepts 1–256 characters
- 12 characters
- Lowercase letters (a-z)
- Yes
- Uppercase letters (A-Z)
- Yes
- Digits (0-9)
- Yes
- Symbols (!@#$...)
- No
Results
- Entropy
- 71.45 bits
- Strength Rating
- Strong — resists sustained offline attacks
- Character Set Size
- 62
- Total Combinations
- 3.226 × 10²¹
- Avg. Crack Time (Online, 100/s)
- 511.17 billion years
- Avg. Crack Time (Offline, 10B/s)
- 5,112 years
Step by step
- 1Values used
- 2Password entropy
- 3Average crack time
- 4Entropy= 71.45 bits
- 5Strength Rating= Strong — resists sustained offline attacks
- 6Character Set Size= 62
- 7Total Combinations= 3.226 × 10²¹
- 8Avg. Crack Time (Online, 100/s)= 511.17 billion years
- 9Avg. Crack Time (Offline, 10B/s)= 5,112 years
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
What is a good password entropy value?
60+ bits is generally considered strong for most purposes, and 80+ bits is very strong even against sustained offline attacks. Below 40 bits, a determined attacker with modest hardware can often crack the password within a practical timeframe.
Why does adding symbols increase entropy so much?
Entropy scales with log2(charset_size), so a larger character set raises the per-character bit contribution. Adding a 32-symbol set roughly doubles the effective charset compared to letters and digits alone, adding about 1 extra bit per character.
Is length or character variety more important?
Length matters more because it multiplies the per-character entropy rather than just increasing the base of the logarithm. Four extra random characters from a small charset often beats a shorter password with every character type enabled.
Why are online and offline crack times so different?
Online attacks are throttled by the target service (login rate limits, lockouts), often to roughly 100 guesses/second or less. Offline attacks against a stolen (and especially unsalted or weakly-hashed) password database can run at billions of guesses per second on GPU hardware.