Password Strength (Entropy) Calculator
By Santaji GadepatilinUpdated October 27, 2026
Password strength is measured in bits of entropy — how many guesses an attacker would need. Longer passwords with more character types are much stronger.
How to use the password strength calculator
Enter the length, choose the character set, and set the attacker’s guessing speed (10 billion per second is a strong offline attack on a fast hash). Entropy and average cracking time are calculated.
Password strength formulas
bits = length × log₂(character set)
average time = 2bits − 1 ÷ guesses per second
Examples (10 billion guesses per second)
| Password | Bits | Average time |
|---|---|---|
| 8 digits | 26.6 | under a second |
| 8 lowercase | 37.6 | about 10 seconds |
| 12 letters + digits | 71.5 | thousands of years |
| 16 printable ASCII | 104.9 | far longer than the age of the universe |
Use a password manager, unique passwords for every site and two-factor authentication.
Character sets
| Characters used | Pool size (N) | Bits per character |
|---|---|---|
| Digits only | 10 | 3.32 |
| Lowercase letters | 26 | 4.70 |
| Upper + lowercase | 52 | 5.70 |
| Letters + digits | 62 | 5.95 |
| All printable ASCII | 95 | 6.57 |
Entropy and strength
| Entropy | Strength (for random passwords) |
|---|---|
| Under 40 bits | Weak |
| 40–60 bits | Moderate |
| 60–80 bits | Strong |
| 80+ bits | Very strong |
Passphrases
A random passphrase of common words can be strong and memorable. Four words chosen randomly from a 7,776-word list (diceware) give 4 × 12.9 = 51.7 bits; six words give 77.5 bits.
Why real passwords are weaker
The formula assumes random characters. Human-chosen passwords like “Summer2024!” follow patterns that attackers try first, so their real strength is far lower than the formula suggests.
Good practice
- Use a password manager to generate and store long random passwords.
- Use a different password for every site.
- Turn on two-factor authentication wherever possible.
- Check whether your passwords have appeared in known data breaches.
Frequently asked questions
What is password entropy?
A measure of unpredictability in bits — log₂ of the number of possible passwords. Each extra bit doubles the guesses needed.
How long should a password be?
At least 12–16 characters for important accounts. A passphrase of several random words is long and easy to remember.
Does this apply to any password?
Only to truly random passwords. Real passwords based on words, names or patterns are cracked far faster.
How long should a password be?
At least 12–16 random characters, or a passphrase of 5–6 random words.
Is a long passphrase better than a short complex password?
Usually yes. Length adds more entropy than symbols, and passphrases are easier to remember.