Randomness Entropy Calculator
Compute Shannon entropy for a random string or passphrase from its alphabet and length, plus the offline crack time.
Inputs
Entropy
95.27bits
Entropy per Symbol
5.95bits
Total Combinations (log₁₀)
28.68
Average Crack Time (log₁₀ years)
9.88
Strength Class
Adequate for short-lived tokens
Assessment
Acceptable only with rate limiting and a short lifetime
Step by step
Values used
Alphabet = Alphanumeric (62); Symbols or words drawn = 16 symbols; Attacker guesses per second = 100,000,000,000 guess/s
Randomness Entropy
Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second.
Inverting for a target strength
symbols needed for a target = ⌈target bits ÷ log₂(alphabet)⌉ — 22 Base64url characters for 128 bits.
Entropy
= 95.27 bits
Entropy per Symbol
= 5.95 bits
Total Combinations (log₁₀)
= 28.68
Average Crack Time (log₁₀ years)
= 9.88
Strength Class
= Adequate for short-lived tokens
Assessment
= Acceptable only with rate limiting and a short lifetime
How it works
The formula assumes every symbol is drawn independently and uniformly, which holds for a CSPRNG but not for anything a human chose. A Base64url character carries exactly 6 bits, an alphanumeric character about 5.95, and an EFF diceware word 12.9. This is the number that decides whether a session token, password-reset link or API key can be guessed — 128 bits of real entropy makes online and offline guessing equally hopeless.
Formulas
Randomness Entropy
Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second.
- alphabet size
- Number of equally likely symbols per position
- length
- Symbols or words drawn independently at random
- entropy
- Bits of uncertainty — each extra bit doubles the search
Inverting for a target strength
symbols needed for a target = ⌈target bits ÷ log₂(alphabet)⌉ — 22 Base64url characters for 128 bits.
Frequently Asked Questions
How is Randomness Entropy calculated?
Shannon entropy = length × log₂(alphabet size); average brute-force time = 2^(entropy − 1) ÷ guesses per second. The formula assumes every symbol is drawn independently and uniformly, which holds for a CSPRNG but not for anything a human chose. A Base64url character carries exactly 6 bits, an alphanumeric character about 5.95, and an EFF diceware word 12.9.
Why does Randomness Entropy matter?
This is the number that decides whether a session token, password-reset link or API key can be guessed — 128 bits of real entropy makes online and offline guessing equally hopeless.
What values do I need to enter?
This calculator takes 3 inputs: Alphabet, Symbols or words drawn, Attacker guesses per second. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Does this apply to human-chosen passwords?
No. The formula requires uniform random selection. A human-chosen 10-character password carries far less than 10 × log₂(94) = 65 bits, because the distribution is heavily skewed. Use a KDF work-factor calculator to model those instead.
How long should a session token be?
At least 128 bits of entropy — 22 Base64url characters or 32 hex characters. That is the OWASP recommendation and it leaves no margin for a birthday collision across even the largest session store.
You might also need
- Nonce Length CalculatorCommonly used together
- Random Number Quality CalculatorCommonly used together
- Hash Collision Probability CalculatorCommonly used together
- RSA Key Size CalculatorAlso in Cryptography
- Quantum Security Readiness CalculatorAlso in Cryptography
- AES Key Strength CalculatorAlso in Cryptography