Score password entropy in bits from its length and character set, with the full keyspace and a strength band.
Entropy measures how many equally likely possibilities an attacker must search. Each extra character multiplies the keyspace by the charset size, which adds a constant log2(charset) bits — 6.57 bits per character for printable ASCII. The figure is only honest for genuinely random passwords; a human-chosen password of the same shape carries far less real entropy. Bits of entropy is the one password metric that maps directly onto attacker work, so it is the number to put in a standard instead of vague rules about mixing symbols.
Password Entropy Score
entropy (bits) = length × log2(charset size), and keyspace = charset size ^ length.
Bits per character by character set
log2(10) = 3.322 · log2(26) = 4.700 · log2(52) = 5.700 · log2(62) = 5.954 · log2(95) = 6.570 bits per character.
entropy (bits) = length × log2(charset size), and keyspace = charset size ^ length. Entropy measures how many equally likely possibilities an attacker must search. Each extra character multiplies the keyspace by the charset size, which adds a constant log2(charset) bits — 6.57 bits per character for printable ASCII. The figure is only honest for genuinely random passwords; a human-chosen password of the same shape carries far less real entropy.
Bits of entropy is the one password metric that maps directly onto attacker work, so it is the number to put in a standard instead of vague rules about mixing symbols.
This calculator takes 2 inputs: Password length, Character set. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
60 bits survives an online attack but not an offline one against a fast hash. 80 bits is the practical floor for anything protecting money or administrative access. 128 bits matches a symmetric key and is what a password manager should generate by default.
Adding one character to a 16-character alphanumeric password adds 5.95 bits. Switching that whole password from alphanumeric to printable ASCII adds only 16 × (6.570 − 5.954) = 9.9 bits. Length is the cheaper lever, which is why NIST SP 800-63B favours length over composition rules.