Password Entropy Calculator
Measure the mathematical strength of passwords and passphrases in bits. Check character sets, estimate crack times under multiple attack tiers, and test setups 100% locally.
Type a password below to analyze its character set distribution and bit count.
Estimated Time to Crack (Brute Force)
Comparison of estimated durations to exhaustively test 50% of the key space under varying hardware guess rates.
| Attack Vector | Guess Speed | Time to Crack |
|---|---|---|
| Online Attack (Throttled API) | 1,000 / sec | Instant |
| Offline Attack (High-end GPU Rig) | 100 Billion / sec | Instant |
| Supercomputer Array (Enterprise Hack) | 100 Trillion / sec | Instant |
My Saved Entropy Profiles
Compare different password profiles stored locally in your browser.
Password Entropy Calculator Guide & FAQs
Understanding Password Entropy Math
Password entropy is a mathematical metric derived from information theory that quantifies the strength and unpredictability of a password. Rather than looking at subjective rules (such as whether a password has mixed casing), entropy evaluates the mathematical complexity in bits. The general formula for standard character-based passwords is:
Entropy (bits) = Length × log2(Charset Pool Size)
The charset pool size represents the number of possible characters chosen. A numeric-only password has a pool size of 10. Adding lowercase alphabetic characters expands it by 26, uppercase by another 26, and special symbols by 32 (totaling 94 possible characters). Increasing the length of a password increases its security exponentially, making length mathematically superior to character complexity rules.
Passphrases vs. Short Passwords
A passphrase is composed of random words selected from a dictionary. Because each word is pulled from a large pool (e.g. the EFF long list of 7,776 words), each added word contributes roughly 12.92 bits of entropy (log2(7776)). Thus, a simple four-word phrase like correct horse battery staple yields over 51.7 bits of entropy, which is harder for computers to crack than a complex, hard-to-remember 8-character string, yet vastly simpler for a human to memorize.
Frequently Asked Questions
What is password entropy?
Password entropy is a mathematical measure of how many guesses it would take an attacker to guess a password using brute force, calculated in bits. Each added bit of entropy doubles the difficulty of guessing the password.
What is a secure entropy score?
Under modern security standards, an entropy score of **60 to 79 bits** is secure for standard personal accounts, while **80 bits or higher** is recommended for high-security, critical credentials (like root keys or master passwords) to withstand offline brute-force attacks.
Why is password length better than complexity?
Adding characters to a password increases length linearly but raises the total combinations exponentially. For example, a 16-character password using only lowercase letters (16 × log2(26) ≈ 75.2 bits) is vastly stronger than an 8-character password using complex symbols (8 × log2(94) ≈ 52.4 bits).