What Is Password Entropy?
Password entropy is a measure of how unpredictable a password is, expressed in bits. The higher the entropy, the more guesses an attacker needs to try before finding the correct password. Entropy is calculated as length multiplied by the base-2 logarithm of the character set size. A password of 12 lowercase letters has about 56 bits of entropy (12 times log2 of 26). The same 12 characters using lowercase, uppercase, digits, and symbols has about 78 bits (12 times log2 of 95). A security engineer in London audits her company's password policy and finds that most employees use passwords with under 40 bits of entropy, which modern GPUs can crack in hours.
Entropy is the foundation of password strength. Length matters more than complexity because each additional character multiplies the search space. To generate high-entropy passwords, use our Password Generator.
What This Calculator Does
This password strength calculator analyzes a password in real time. It detects which character classes are present (lowercase, uppercase, digits, symbols), computes the character set size, calculates entropy in bits, assigns a strength rating, and estimates how long it would take to crack the password at a rate of 10 billion guesses per second.
- Inputs: A password string
- Outputs: Entropy in bits, strength rating, character pool size, and estimated crack time
How the Calculation Works
entropy = length × log2(charsetSize)
crackTime = 2^entropy / (2 × guessesPerSecond)
The character set size is the sum of the detected character class sizes: 26 for lowercase, 26 for uppercase, 10 for digits, and approximately 33 for symbols. The crack time assumes an offline attack where the attacker can try 10 billion guesses per second, which is realistic for modern GPU clusters. The factor of 2 in the denominator represents the average case of finding the password halfway through the search space. The NIST SP 800-63B guidelines provide authoritative recommendations on password strength and authentication.
Strength Ratings Explained
- Weak (under 28 bits): Crackable almost instantly. Common words and short passwords.
- Fair (28-35 bits): Crackable in minutes to hours. Short passwords with limited character sets.
- Good (36-59 bits): Crackable in days to years with significant computing power.
- Strong (60-127 bits): Practically uncrackable with current technology.
- Very Strong (128+ bits): Uncrackable even with future technology. Equivalent to AES-128 key strength.
Limitations
This calculator measures theoretical entropy based on character set and length. It does not detect dictionary words, common patterns, repeated characters, or keyboard sequences, all of which reduce real-world strength below the theoretical estimate. A password like "aaaaaaaaaaaa" would report high entropy but is trivially crackable. For real-world password auditing, use a tool like zxcvbn that checks against dictionaries and patterns. For encoding sensitive data, try our Base64 Encode / Decode or URL Encode / Decode tools.