Password Entropy
Calculate password entropy in bits based on length and character set.
Inputs
Entropy
71.45bits
Strength Rating
Strong — resists sustained offline attacks
Character Set Size
62
Total Combinations
3.23 × 10²¹
Avg. Crack Time (Online, 100/s)
511.17 billion years
Avg. Crack Time (Offline, 10B/s)
5,112 years
Step by step
Values used
Password Length = 12 characters; Lowercase letters (a-z) = Yes; Uppercase letters (A-Z) = Yes; Digits (0-9) = Yes; Symbols (!@#$...) = No
Password entropy
entropy = length × log2(charset_size)
Average crack time
time = (charset_size^length / 2) / guesses_per_second
Entropy
= 71.45 bits
Strength Rating
= Strong — resists sustained offline attacks
Character Set Size
= 62
Total Combinations
= 3,226,270,000,000,000,000,000
Avg. Crack Time (Online, 100/s)
= 511.17 billion years
Avg. Crack Time (Offline, 10B/s)
= 5,112 years
How it works
Password entropy quantifies unpredictability in bits: entropy = length × log2(charset_size). Each character position contributes log2(charset_size) bits because that's how many bits are needed to represent one symbol chosen uniformly from the character set. A larger charset or greater length both increase entropy, but length has a compounding effect since it multiplies the per-character contribution. Crack time estimates assume a brute-force search over the full keyspace, averaging half the total combinations before a match is found, at a given guesses-per-second rate.
Formulas
Password entropy
entropy = length × log2(charset_size)
- L
- Password length in characters
- C
- Character set size (e.g. 26+26+10+32)
Average crack time
time = (charset_size^length / 2) / guesses_per_second
- r
- Attacker's guesses per second
Frequently Asked Questions
What is a good password entropy value?
60+ bits is generally considered strong for most purposes, and 80+ bits is very strong even against sustained offline attacks. Below 40 bits, a determined attacker with modest hardware can often crack the password within a practical timeframe.
Why does adding symbols increase entropy so much?
Entropy scales with log2(charset_size), so a larger character set raises the per-character bit contribution. Adding a 32-symbol set roughly doubles the effective charset compared to letters and digits alone, adding about 1 extra bit per character.
Is length or character variety more important?
Length matters more because it multiplies the per-character entropy rather than just increasing the base of the logarithm. Four extra random characters from a small charset often beats a shorter password with every character type enabled.
Why are online and offline crack times so different?
Online attacks are throttled by the target service (login rate limits, lockouts), often to roughly 100 guesses/second or less. Offline attacks against a stolen (and especially unsalted or weakly-hashed) password database can run at billions of guesses per second on GPU hardware.