Password entropy expresses how many guesses an attacker would need in the worst case, as a power of two. A password drawn at random from a pool of R characters with length L has Rᴸ possibilities, which is 2 to the power L × log₂(R). Each extra bit doubles the work: 40 bits is about a trillion possibilities and falls to a modern GPU rig in seconds, 60 bits holds out for days to years depending on the hash, and 80 bits or more is beyond any realistic brute-force attack.
The pool size depends on which kinds of characters appear: 26 for lowercase only, 52 with uppercase, 62 with digits and 94 for all printable ASCII symbols (32 punctuation characters). Length matters more than variety. Going from lowercase to the full 94-character set adds about 1.85 bits per character, while every extra lowercase character adds 4.7 bits, so a 16-character lowercase passphrase (75 bits) beats an 11-character mix of everything (72 bits).
The formula only holds for randomly generated passwords. Human-chosen passwords like “Password1!” score highly on paper but are cracked instantly with dictionaries and rules, which is why NIST recommends checking passwords against breached-password lists and why a password manager is the best source of high-entropy passwords.
How to use the Password Strength
- Describe the password by
- Password length
- Character set
- Lowercase Latin letters (a–z)
- Uppercase Latin letters (A–Z)
- Digits (0–9)
- Special characters
- Special character pool size: 32 printable ASCII symbols; 33 if the space counts.
- Custom set 1: characters used
- Custom set 1: pool size: e.g. 33 for Russian lowercase letters.
- Custom set 2: characters used
- Custom set 2: pool size
- Custom set 3: characters used
- Custom set 3: pool size
- Attacker’s guesses per second: 10 billion/s ≈ a GPU rig against a fast hash such as MD5; slow hashes like bcrypt allow only thousands per second.
Results update as you type, every field has its own unit menu, and everything is calculated in your browser.
How it works
Choose whether to describe the password by its length and one character set, or by counting each type of character. The pool R is the sum of the sizes of all character types that occur at least once; the entropy is L × log₂ R, and the cracking time assumes an attacker must, on average, try half of all possibilities at the guess rate you enter.
Worked example
A random 14-character password with 6 lowercase letters, 3 capitals, 2 digits and 3 symbols draws from a pool of 26 + 26 + 10 + 32 = 94 characters. Its entropy is 14 × log₂ 94 = 14 × 6.555 = 91.8 bits. Even at 10 billion guesses per second, trying half of the 2⁹¹·⁸ possibilities would take about 2.1 × 10¹⁷ seconds, roughly 6.7 billion years. The lowercase word “incorrect” alone gives only 9 × 4.70 = 42.3 bits.
Entropy per character
| Character pool | Size | Bits per character | Length for 80 bits |
|---|---|---|---|
| Digits | 10 | 3.32 | 25 |
| Lowercase | 26 | 4.70 | 18 |
| Letters | 52 | 5.70 | 15 |
| Letters + digits | 62 | 5.95 | 14 |
| Printable ASCII | 94 | 6.55 | 13 |
| Diceware words | 7,776 | 12.9 per word | 7 words |
Inputs explained
| Field | What to enter |
|---|---|
| Describe the password by | Choose one: Length and character set, Count of each character type |
| Password length | In characters |
| Character set | Choose one: Digits only (10), Lowercase letters (26), Lower + uppercase letters (52), Letters + digits (62) … |
| Lowercase Latin letters (a–z) | A number |
| Uppercase Latin letters (A–Z) | A number |
| Digits (0–9) | A number |
| Special characters | A number |
| Special character pool size | A number. 32 printable ASCII symbols; 33 if the space counts. |
| Custom set 1: characters used | A number |
| Custom set 1: pool size | A number. e.g. 33 for Russian lowercase letters. |
| Custom set 2: characters used | A number |
| Custom set 2: pool size | A number |
| Custom set 3: characters used | A number |
| Custom set 3: pool size | A number |
| Attacker’s guesses per second | A number. 10 billion/s ≈ a GPU rig against a fast hash such as MD5; slow hashes like bcrypt allow only thousands per second. |
What each result means
- Average time to crack = 2^([Entropy] – 1)÷[Attacker’s guesses per second]÷31557600
- Average time to crack (choose unit) = 2^([Entropy] – 1)÷[Attacker’s guesses per second]
- Password length = [Length]
- Character pool size = [Pool]
- Possible passwords ≈ 10 to the power of = [Entropy]×log10(2)
Formula
E = L × log₂(R) (L = length, R = size of the character pool)
Possible passwords = Rᴸ = 2ᴱ · average guesses to crack = 2ᴱ⁻¹ · time = 2ᴱ⁻¹ ÷ guesses per second
Worked example
Inputs: Describe the password by: Count of each character type; Lowercase Latin letters (a–z): 6; Uppercase Latin letters (A–Z): 3; Digits (0–9): 2; Special characters: 3; Special character pool size: 32; Custom set 1 – characters used: 0; Custom set 1 – pool size: 33; Custom set 2 – characters used: 0; Custom set 2 – pool size: 24; Custom set 3 – characters used: 0; Custom set 3 – pool size: 10; Attacker’s guesses per second: 10,000,000,000.
Results: Entropy = 91.8 bits; Average time to crack = 6,662,787,888.97 years; Average time to crack (choose unit) = 6,662,787,888.969 years; Password length = 14 characters; Character pool size = 94; Entropy per character = 6.55 bits; Possible passwords ≈ 10 to the power of = 27.6.
Key terms
- Entropy (bits)
- log₂ of the number of equally likely passwords.
- Character pool
- The set of characters a password is drawn from.
- Brute-force attack
- Trying every possible password until one matches.
- Passphrase
- A password made of several random words.
Frequently asked questions
What is a good password entropy?
Under 40 bits is weak, 40–60 fair, 60–80 strong and over 80 bits very strong. Use at least 60 bits for important accounts and 80+ for master passwords.
How much entropy does an 8-character password have?
With all 94 printable characters, 8 × log₂ 94 ≈ 52.4 bits; with lowercase only, 37.6 bits.
Is length or complexity more important?
Length. Each lowercase character adds 4.7 bits, while switching from lowercase to the full ASCII set adds only 1.85 bits per character.
How strong is a diceware passphrase?
Each word from the 7,776-word list adds 12.9 bits, so six words give about 77.5 bits.
Does this apply to passwords I made up?
No, the formula assumes random choice. Human passwords follow patterns that dictionary attacks exploit, so their real strength is far lower.
What guess rate should I assume?
Online attacks are limited to a few guesses per second; offline attacks on fast hashes reach billions per second, on bcrypt or Argon2 only thousands.
Why does the calculator not ask for my password?
It does not need it. Only the length and the types of characters matter, so nothing sensitive has to be typed.