Password Entropy Calculator
Estimate a random password’s entropy in bits and how long an offline attack would take to crack it — from length and character set only.
How it works
entropy (bits) = length × log₂(character-set size)
Entropy counts how many guesses an attacker needs in the worst case: a set of 94 symbols carries log₂(94) ≈ 6.55 bits per character, so entropy grows linearly with length but only logarithmically with alphabet size. The crack times assume an offline attacker testing 10¹⁰ guesses per second against a stolen, fast-hashed password database — a realistic modern GPU rig. Online login attempts are millions of times slower than that.
Worked example
A 16-character random password over ~94 symbols: 16 × 6.55 = 104.9 bits, about 4 × 10³¹ combinations — around 10¹⁴ years to search at 10¹⁰ guesses per second. Dropping to 8 characters collapses it to 52 bits, crackable in days on the same rig.
Frequently asked questions
Does this apply to the password I actually use?
Only if it was generated randomly. The formula assumes every character is an independent random pick — human-chosen passwords built from words, names, dates and predictable substitutions have far less real entropy than their length suggests, and crackers attack those patterns first.
Is my password sent anywhere when I use this?
No — this calculator never sees a password at all. It only takes a length and a character-set choice; there is nothing to transmit, store or leak.
How many bits are enough?
Common guidance: 60+ bits resists serious offline attacks, and 80–100+ is comfortable long-term. Four to five random dictionary words (a passphrase) reach ~50–65 bits while staying memorable; a password manager makes 100+ bits effortless.
Related calculators
This calculator is for educational purposes. Double-check important results before acting on them.