Every extra character multiplies the number of possibilities. Length matters more than adding symbols.
How to use the Password Strength
- Password length
- Character set
- Guesses per second
Results update as you type, and every field accepts the units shown in its menu.
How it works
The number of possible passwords is the character set size raised to the length; entropy is its base-2 logarithm.
Inputs explained
| Field | What to enter |
|---|---|
| Password length | A number |
| Character set | Choose one: Digits only (10), Lowercase (26), Upper + lowercase (52), Letters + digits (62) … |
| Guesses per second | A number |
What each result means
- Entropy = [Password length]×ln([Character set])÷ln(2)
- Average time to crack = 2^([Entropy] – 1)÷[Guesses per second]÷31557600
Example values
How the main result changes when Password length changes and everything else stays at the example values above:
| Password length | Entropy (bits) |
|---|---|
| 7 | 45.9 |
| 10.5 | 68.8 |
| 14 | 91.8 |
| 17.5 | 114.7 |
| 21 | 137.6 |
| 28 | 183.5 |
Formula
Entropy (bits) = length × log₂(character set size)Guesses = 2^entropy ÷ 2 on averageWorked example
Inputs — Password length: 14; Character set: All printable ASCII (94); Guesses per second: 10,000,000,000.
Results — Entropy = 91.8 bits; Average time to crack = 6,662,787,888.97 years.
Frequently asked questions
Does this apply to passwords I chose myself?
No; human-chosen passwords are far weaker than their length suggests.
What is best?
Use a password manager to generate long random passwords, and enable two-factor authentication.
What formula does the Password Strength use?
Entropy (bits) = length × log₂(character set size).