Password Entropy Calculator
Measure the strength of your password with entropy, the mathematical measure of randomness measured in bits. This calculator analyzes character set diversity, length, and estimates how long it would take to crack your password using brute force.
What Is Password Entropy?
Password entropy is a measure of how unpredictable a password is, expressed in bits. Each bit of entropy doubles the number of guesses an attacker would need to try on average to crack your password through brute force. The higher the entropy, the stronger the password.
The entropy of a password is calculated using the formula:Entropy = log₂(N^L), where N is the size of the character set (the number of possible characters) and L is the length of the password.
Character Set Sizes
Different character sets provide different amounts of entropy per character:
- Digits only (0-9): 10 characters , 3.32 bits per character
- Lowercase letters (a-z): 26 characters , 4.70 bits per character
- Lowercase + digits: 36 characters , 5.17 bits per character
- Mixed case letters: 52 characters , 5.70 bits per character
- Mixed case + digits: 62 characters , 5.95 bits per character
- All printable ASCII: 95 characters , 6.57 bits per character
Entropy Strength Levels
| Entropy (bits) | Rating | Description |
|---|---|---|
| < 28 | Very Weak | Cracked instantly , seconds |
| 28 – 40 | Weak | Cracked in seconds to minutes |
| 40 – 60 | Moderate | Cracked in hours to weeks |
| 60 – 80 | Strong | Cracked in years to centuries |
| 80 – 100 | Very Strong | Millions of years |
| > 100 | Excellent | Beyond computational feasibility |
Why Length Matters More Than Complexity
While adding special characters increases entropy per character,length is the single most important factor in password strength. A 20-character lowercase password has more entropy (94 bits) than an 8-character password using all character types (52 bits).
Adding one special character to an 8-character password adds about 5 bits of entropy. Adding four more lowercase letters adds about 19 bits. Both help, but length wins.
Best Password Practices
- Use a password manager to generate unique, random passwords of 16+ characters for every account.
- Use a passphrase of 4-6 random words (e.g., "correct horse battery staple") , both strong and memorable.
- Enable multi-factor authentication (MFA) on all accounts that support it.
- Never reuse passwords across different accounts.
❓ Password Entropy Calculator FAQ
What is password entropy?
Password entropy is a measure of randomness measured in bits. Each bit doubles the number of possible combinations an attacker must try. Higher entropy means a stronger password.
How is password entropy calculated?
Entropy = log₂(N^L), where N is the number of possible characters (character set size) and L is the password length.
What is a good entropy score?
60+ bits is considered strong (years to crack), 80+ bits is very strong (millions of years), and 100+ bits is excellent (beyond computational feasibility).
Does a complex password always mean high entropy?
Not necessarily. A password like "P@ssw0rd!" uses special characters but is common and predictable. Entropy assumes uniform random selection , real-world attackers also use dictionary and pattern attacks.
What is the best password strategy?
Use a password manager to generate unique, random passwords of 16+ characters for every account. Use a memorable passphrase (4+ random words) for your password manager's master password.
Is a longer password always better?
Yes, length is the single most important factor. A 20-character lowercase password (94 bits) is stronger than an 8-character password using all character types (52 bits).
Does this calculator send my password anywhere?
No. All calculations are performed entirely in your browser. Your password is never transmitted, stored, or logged.
What is the character set size for my password?
The calculator automatically detects which character types you use (lowercase, uppercase, digits, symbols) and sums their pool sizes to determine N.
How accurate is the crack time estimate?
Crack times are estimates based on the number of guesses per second you select. Real-world times vary based on the attacker's hardware and method.
Is this calculator free?
Yes, this calculator is completely free to use. No registration or personal data storage is required.