Password Entropy Calculator
How much entropy a password has, and how long it survives at a stated guess rate — the honest arithmetic, not a strength meter.
Entropy is length times the log of the character set.
How the password entropy calculator works
Entropy is length times the log of the character set. A 12-character password from 95 printable characters is 78.8 bits, which sounds enormous — and is, against online guessing.
Against offline cracking it is a different question, because the guess rate is the whole answer. At a billion guesses a second the same password lasts millennia; against a fast GPU farm doing a trillion, it lasts years; against a weak hash it can fall in hours. The password does not change — the attack does.
Formula: entropy = length × log₂(alphabet); time = 2^(entropy−1) / rate
Worked examples
| Inputs | Entropy (bits) | Note |
|---|---|---|
| 12 characters, all four sets | 78.84 | 78.8 bits |
| Lowercase only | 56.41 | 56.4 bits — much weaker |
| A 20-character passphrase | 131.4 | over 131 bits |
FAQFrequently asked questions
How many bits is a strong password?
Eighty is a reasonable floor for anything that matters, and 100 or more for a password protecting other passwords.
Does this measure my actual password?
No — it measures a random password of that shape. A real password chosen by a human has far less entropy than its length suggests, because the choices are not random.
Why does the guess rate matter so much?
Because it is the denominator. The same password is unbreakable against online guessing and trivial against a GPU farm attacking a fast hash.
Is a passphrase better?
Usually. Four random dictionary words from a 7,776-word list is about 51 bits and far easier to remember than a 9-character mixed string of the same strength.
What about the hash?
It matters more than the password. bcrypt or Argon2 deliberately slow guessing to thousands per second; an unsalted fast hash allows billions.
Where these figures come from
- IEC 80000-13 — Information science and technology (quantities and units) — the decimal (kB, MB) versus binary (KiB, MiB) prefixes used throughout
- RFC 4632 — Classless Inter-domain Routing (CIDR) — the address-plan arithmetic behind the subnet calculator
- RFC 1918 — Address Allocation for Private Internets — the private ranges the subnet calculator recognises
- NIST SP 800-63B — Digital Identity Guidelines, Authentication — length over composition rules; the basis of the password guidance here
- NIST SP 800-57 Part 1 — Recommendation for Key Management — key-strength comparisons used by the key-space calculator
- National Cyber Security Centre — password guidance — UK national guidance on password policy
Last checked: September 2026. Units follow the SI decimal convention (IEC 80000-13 defines the binary alternatives); network and security figures cite the defining standard.