Skip to content
ENExplore Calculators

Password Strength Score Calculator

Turn length, character classes, breach status and dictionary content into a single 0–100 password strength score.

About Password Strength Score Calculator

Entropy carries three quarters of the score, scaled so that 100 bits earns full marks. Character-class variety contributes the remaining quarter, because it is what actually widens the charset an attacker must search. Two hard penalties then apply: a password that appears in a breach corpus is already a single lookup away from compromise, and one built on a dictionary word falls to a mangled-wordlist attack long before brute force. A single score is what you can gate a signup form or an audit report on, and it prices in the two failures — reuse and dictionary words — that raw entropy maths completely misses.

Formula

Password Strength Score

score = 0.75 × min(100, entropy ÷ 100 bits × 100) + 6.25 × classes used − 45 (breached) − 20 (dictionary word), clamped to 0–100.

entropy
length × log2(effective charset)
classes
How many of lowercase, uppercase, digit and symbol appear

Worked example

With the default values below, Password Strength Score Calculator returns Strength Score of 84. Change any input above and every figure here is recalculated in your browser.

Inputs used

Password lengthaccepts 1–128 characters
12 characters
Contains lowercase letters
Yes
Contains uppercase letters
Yes
Contains digits
Yes
Contains symbols
Yes
Appears in a known breach corpus
No
Built around a dictionary word or name
No

Results

Strength Score
84 / 100
Grade
B — Good
Nominal Entropy
78.8 bits
Effective Character Set
95 characters
Character Classes Used
4 of 4

Step by step

  1. 1Values used
  2. 2Password Strength Score
  3. 3Strength Score= 84 / 100
  4. 4Grade= B — Good
  5. 5Nominal Entropy= 78.8 bits
  6. 6Effective Character Set= 95 characters
  7. 7Character Classes Used= 4 of 4

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Password Strength Score calculated?

score = 0.75 × min(100, entropy ÷ 100 bits × 100) + 6.25 × classes used − 45 (breached) − 20 (dictionary word), clamped to 0–100. Entropy carries three quarters of the score, scaled so that 100 bits earns full marks. Character-class variety contributes the remaining quarter, because it is what actually widens the charset an attacker must search. Two hard penalties then apply: a password that appears in a breach corpus is already a single lookup away from compromise, and one built on a dictionary word falls to a mangled-wordlist attack long before brute force.

Why does Password Strength Score matter?

A single score is what you can gate a signup form or an audit report on, and it prices in the two failures — reuse and dictionary words — that raw entropy maths completely misses.

What values do I need to enter?

This calculator takes 7 inputs: Password length, Contains lowercase letters, Contains uppercase letters, Contains digits, Contains symbols, Appears in a known breach corpus, Built around a dictionary word or name. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is a breached password penalised so heavily?

Because entropy is irrelevant once a password is on a list. Attackers try the list first, so a 20-character breached password falls in one guess while a random 10-character one survives billions. NIST SP 800-63B requires checking new passwords against a breach corpus for exactly this reason.

Is this the same as a password meter in a browser?

Browser meters mostly count characters and classes. This adds the entropy maths and the breach and dictionary penalties, which is closer to how tools like zxcvbn estimate real guessability.

Related Calculators

Password Strength Score Calculator | Calcrivo