Password Strength Calculator
How strong a password really is — its entropy in bits, the number of guesses needed, and how long that takes an attacker at realistic cracking speeds.
Entropy measures unpredictability in bits: each bit doubles the number of guesses.
How the password strength calculator works
Entropy measures unpredictability in bits: each bit doubles the number of guesses. A password drawn at random from a character set of size C with length L has L × log₂(C) bits. The crucial word is *random* — this measures the strength of the pattern you describe, not of a password a person chose, because human choices cluster heavily and password crackers try those first. A memorable phrase of real words picked at random is usually stronger than a short string of symbols, which is why NIST now recommends length over composition rules.
Formula: entropy = length × log₂(character set size); guesses = 2^entropy ÷ 2 on average
Worked examples
| Inputs | Entropy | Note |
|---|---|---|
| 12 characters, mixed case and digits | 71.5 bits | 71.5 bits |
| 8 characters, lower case only | 37.6 bits | 37.6 bits — cracked in seconds |
| Four random words (a passphrase) | 51.7 bits | 51.7 bits, and far easier to remember |
| Six random words | 77.5 bits | 77.5 bits — very strong |
FAQFrequently asked questions
What is entropy in bits?
A measure of how many guesses are needed. Each bit doubles the work: 40 bits is about a trillion possibilities, 80 bits is a trillion trillion.
Is this my actual password strength?
Only if the password was generated randomly. Crackers try common words, substitutions and leaked passwords first, so a human-chosen password matching a pattern is far weaker than the pattern suggests.
Are symbols better than length?
No. Adding one character to a mixed-case alphanumeric password adds about 6 bits; switching to symbols adds about 0.6 bits per character. Length wins, which is why NIST now recommends it over composition rules.
Why are passphrases recommended?
Four words drawn at random from a 7,776-word list give about 52 bits and are far easier to remember than a 9-character jumble of similar strength.
What crack rate should I assume?
It depends entirely on how the password is stored. A fast hash like unsalted SHA-1 falls at billions of guesses a second; bcrypt or Argon2 at high cost settings reduces that to thousands.
Where these figures come from
- IEC 80000-13 — Information science and technology (quantities and units) — the decimal (kB, MB) versus binary (KiB, MiB) prefixes used throughout
- RFC 4632 — Classless Inter-domain Routing (CIDR) — the address-plan arithmetic behind the subnet calculator
- RFC 1918 — Address Allocation for Private Internets — the private ranges the subnet calculator recognises
- NIST SP 800-63B — Digital Identity Guidelines, Authentication — length over composition rules; the basis of the password guidance here
- NIST SP 800-57 Part 1 — Recommendation for Key Management — key-strength comparisons used by the key-space calculator
- NIST — Digital Identity Guidelines (SP 800-63) — US federal authentication standard
Last checked: September 2026. Units follow the SI decimal convention (IEC 80000-13 defines the binary alternatives); network and security figures cite the defining standard.