Calculate password entropy in bits based on length and character set.
Password entropy quantifies unpredictability in bits: entropy = length × log2(charset_size). Each character position contributes log2(charset_size) bits because that's how many bits are needed to represent one symbol chosen uniformly from the character set. A larger charset or greater length both increase entropy, but length has a compounding effect since it multiplies the per-character contribution. Crack time estimates assume a brute-force search over the full keyspace, averaging half the total combinations before a match is found, at a given guesses-per-second rate.
Password entropy
entropy = length × log2(charset_size)
Average crack time
time = (charset_size^length / 2) / guesses_per_second
60+ bits is generally considered strong for most purposes, and 80+ bits is very strong even against sustained offline attacks. Below 40 bits, a determined attacker with modest hardware can often crack the password within a practical timeframe.
Entropy scales with log2(charset_size), so a larger character set raises the per-character bit contribution. Adding a 32-symbol set roughly doubles the effective charset compared to letters and digits alone, adding about 1 extra bit per character.
Length matters more because it multiplies the per-character entropy rather than just increasing the base of the logarithm. Four extra random characters from a small charset often beats a shorter password with every character type enabled.
Online attacks are throttled by the target service (login rate limits, lockouts), often to roughly 100 guesses/second or less. Offline attacks against a stolen (and especially unsalted or weakly-hashed) password database can run at billions of guesses per second on GPU hardware.