Password Entropy Calculator
Enter a password length and choose which character types it uses to see its entropy in bits, a strength rating, the total number of possible combinations, and a rough estimate of how long it would take to crack.
How this calculation works
Entropy measures how unpredictable a randomly generated password is. It is calculated as bits = length × log2(pool size), where pool size is the number of distinct characters available per position: 26 for lowercase letters, 26 for uppercase, 10 for digits, and 32 for common symbols. Selecting more character types increases the pool, and each extra character in the pool adds a little entropy to every position.
Every extra character of length multiplies the number of possible passwords by the pool size, so length has an outsized effect: adding 4 characters to a lowercase-only password roughly doubles its entropy, while switching on symbols only adds a few bits total. This is why 'length beats complexity' is the standard advice — a long passphrase of ordinary words is usually far stronger than a short jumble of symbols.
Crack time is estimated by assuming an attacker can try 10 billion (1e10) guesses per second, a rate typical of offline attacks against a stolen, unsalted or weakly hashed password file using modern GPU hardware. Online attacks against a live login form are usually far slower because of rate-limiting, so real-world crack times for online guessing are often much longer than shown here.
Worked example
Character pool sizes used in this calculation
Each character category adds a fixed number of possibilities per character position. This calculator adds them together to get the total pool size, then applies bits = length × log2(pool).
| Character set | Pool size | Example |
|---|---|---|
| Lowercase letters | 26 | a, b, c … z |
| Uppercase letters | 26 | A, B, C … Z |
| Digits | 10 | 0–9 |
| Symbols | 32 | ! @ # $ % ^ & * ( ) - _ = + etc. |
| Lowercase + digits | 36 | e.g. 'a1b2c3d4' |
| Lowercase + uppercase + digits | 62 | e.g. 'Kx9mQ2p7' |
| All four sets | 94 | e.g. 'Kx9!mQ2#p7' |
Strength ratings explained
- Very weak (under 28 bits): guessable almost instantly, comparable to a 4-digit PIN.
- Weak (28–35 bits): breakable within minutes to hours by an automated attack.
- Reasonable (36–59 bits): adequate for low-value or throwaway accounts, not for anything sensitive.
- Strong (60–127 bits): solid protection for most personal and financial accounts against offline cracking.
- Very strong (128+ bits): effectively unbreakable with current and near-future computing power.
Why length beats complexity
Every additional character multiplies the total number of possible passwords by the size of the character pool, while turning on a new character type only widens the pool for characters you already have. Going from 8 to 12 characters in a lowercase-only password (pool 26) roughly multiplies the keyspace by 26⁴ — over 450,000 times larger — while adding symbols to an existing 8-character password only multiplies it by roughly (58/26)⁸ ≈ 218 times. This is why security guidance since the mid-2010s (including NIST SP 800-63B) favors long, memorable passphrases over short, symbol-stuffed passwords that are hard to type and easy to forget.
Assumptions behind the crack-time estimate
The estimated crack time assumes an attacker who already has the password hash (for example, from a stolen database) and can attempt 10 billion guesses per second — a realistic rate for cracking a fast, unsalted hash with modern GPUs. Real-world crack times vary enormously depending on the hashing algorithm used to store the password (bcrypt and Argon2 are deliberately slow and can cut guess rates to a few thousand per second), whether the password appears in leaked-password dictionaries, and whether the attack is offline or rate-limited online. Use the figure to compare password choices relatively, not as a literal guarantee.