Randomness Entropy Calculator

Compute Shannon entropy for a random string or passphrase from its alphabet and length, plus the offline crack time.

About Randomness Entropy Calculator

The formula assumes every symbol is drawn independently and uniformly, which holds for a CSPRNG but not for anything a human chose. A Base64url character carries exactly 6 bits, an alphanumeric character about 5.95, and an EFF diceware word 12.9. This is the number that decides whether a session token, password-reset link or API key can be guessed — 128 bits of real entropy makes online and offline guessing equally hopeless.

Formulas

Randomness Entropy

Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second.

alphabet size: Number of equally likely symbols per position
length: Symbols or words drawn independently at random
entropy: Bits of uncertainty — each extra bit doubles the search

Inverting for a target strength

symbols needed for a target = ⌈target bits ÷ log₂(alphabet)⌉ — 22 Base64url characters for 128 bits.

Worked example

With the default values below, Randomness Entropy Calculator returns Entropy of 95.27. Change any input above and every figure here is recalculated in your browser.

Inputs used

Alphabetone of Decimal digits (10), Hexadecimal (16), Lowercase letters (26), Base32 (32), Alphanumeric (62), Base64url (64), Printable ASCII (94), EFF diceware word list (7776): Alphanumeric (62)
Symbols or words drawnaccepts 1–256 symbols: 16 symbols
Attacker guesses per secondminimum 1 guess/s: 100,000,000,000 guess/s

Results

Entropy: 95.27 bits
Entropy per Symbol: 5.95 bits
Total Combinations (log₁₀): 28.68
Average Crack Time (log₁₀ years): 9.88
Strength Class: Adequate for short-lived tokens
Assessment: Acceptable only with rate limiting and a short lifetime

Step by step

1Values used
2Randomness Entropy
3Inverting for a target strength
4Entropy= 95.27 bits
5Entropy per Symbol= 5.95 bits
6Total Combinations (log₁₀)= 28.68
7Average Crack Time (log₁₀ years)= 9.88
8Strength Class= Adequate for short-lived tokens
9Assessment= Acceptable only with rate limiting and a short lifetime

Assumptions and limits

The result is derived only from the 3 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Randomness Entropy calculated?

Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second. The formula assumes every symbol is drawn independently and uniformly, which holds for a CSPRNG but not for anything a human chose. A Base64url character carries exactly 6 bits, an alphanumeric character about 5.95, and an EFF diceware word 12.9.

Why does Randomness Entropy matter?

This is the number that decides whether a session token, password-reset link or API key can be guessed — 128 bits of real entropy makes online and offline guessing equally hopeless.

What values do I need to enter?

This calculator takes 3 inputs: Alphabet, Symbols or words drawn, Attacker guesses per second. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Does this apply to human-chosen passwords?

No. The formula requires uniform random selection. A human-chosen 10-character password carries far less than 10 × log₂(94) = 65 bits, because the distribution is heavily skewed. Use a KDF work-factor calculator to model those instead.

How long should a session token be?

At least 128 bits of entropy — 22 Base64url characters or 32 hex characters. That is the OWASP recommendation and it leaves no margin for a birthday collision across even the largest session store.