Compute Shannon entropy for a random string or passphrase from its alphabet and length, plus the offline crack time.
The formula assumes every symbol is drawn independently and uniformly, which holds for a CSPRNG but not for anything a human chose. A Base64url character carries exactly 6 bits, an alphanumeric character about 5.95, and an EFF diceware word 12.9. This is the number that decides whether a session token, password-reset link or API key can be guessed — 128 bits of real entropy makes online and offline guessing equally hopeless.
Randomness Entropy
Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second.
Inverting for a target strength
symbols needed for a target = ⌈target bits ÷ log₂(alphabet)⌉ — 22 Base64url characters for 128 bits.
Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second. The formula assumes every symbol is drawn independently and uniformly, which holds for a CSPRNG but not for anything a human chose. A Base64url character carries exactly 6 bits, an alphanumeric character about 5.95, and an EFF diceware word 12.9.
This is the number that decides whether a session token, password-reset link or API key can be guessed — 128 bits of real entropy makes online and offline guessing equally hopeless.
This calculator takes 3 inputs: Alphabet, Symbols or words drawn, Attacker guesses per second. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No. The formula requires uniform random selection. A human-chosen 10-character password carries far less than 10 × log₂(94) = 65 bits, because the distribution is heavily skewed. Use a KDF work-factor calculator to model those instead.
At least 128 bits of entropy — 22 Base64url characters or 32 hex characters. That is the OWASP recommendation and it leaves no margin for a birthday collision across even the largest session store.