Password Entropy Calculator
Measure a password’s entropy in bits from its length and character variety, with a strength rating and a rough offline crack-time estimate. Runs in your browser.
Entropy
-
Show the math
The pool is the number of distinct characters the password could be drawn from (26 for lowercase, 26 for uppercase, 10 for digits and 32 for common symbols, added up for the classes you used:
entropy (bits) = length × log₂(pool size)
Crack time assumes a fast offline attack of 10 billion guesses a second against an average of half the keyspace) a rough guide, not a guarantee. Real attackers also try dictionary words and patterns first, so a random password of the same length is stronger. Everything is computed in your browser and nothing you type is sent anywhere.
What this does
A password-entropy calculator measures a password’s strength in bits from its length and character variety, with a rating and a rough offline crack-time estimate.
How to use it
- Type or paste a password.
- Read the entropy in bits.
- See the strength rating.
- Note the rough crack time.
How it works
The pool is 26 lowercase, 26 uppercase, 10 digits and about 32 symbols, added for the classes used. Each extra bit doubles the possibilities, and length raises entropy fastest.
entropy = length × log2(character pool)
Understanding your result
Entropy in bits is a measure of guess resistance, where each extra bit doubles the work to crack it, and length raises it faster than adding symbol types. Treat the crack-time as a rough offline estimate against fast hardware, not a promise, and remember it assumes a truly random password: a dictionary word dressed up with substitutions is far weaker than its bit count suggests.
Example
Under 28 bits is very weak, 60+ is strong and 128+ is very strong.
Sources & methodology
Last updated .
Frequently asked questions
How is password entropy calculated?
Entropy in bits is the length multiplied by the base-2 logarithm of the character pool, 26 for lowercase, 26 for uppercase, 10 for digits and about 32 for symbols, added up for the classes used. Each extra bit doubles the number of possible passwords.
How many bits is strong enough?
As a rough guide, under 28 bits is very weak, 60+ is strong and 128+ is very strong. Adding length raises entropy fastest because it multiplies the work for every extra character.
Is my password sent anywhere?
No. The password is analysed entirely in your browser and is never transmitted, logged or stored.
Related tools
IP Subnet Calculator
Work out the network and broadcast addresses, host range, subnet mask and usable host count for any IPv4 address and CIDR prefix. Calculates in your browser.
User Agent Parser
Decode a browser user-agent string into its browser, version, rendering engine, operating system and device type. Parses in your browser.
MAC Address Lookup
Look up the manufacturer behind any MAC address, split it into its OUI and device parts, and see whether it is unicast/multicast and universal/locally administered. Matched against the bundled IEEE registry in your browser.
Uptime & SLA Calculator
Turn an availability target like 99.9% into the downtime it allows per day, week, month, quarter and year. See exactly what each “nine” costs. Calculates in your browser.