Measure password strength the cryptographic way: length and character classes give the pool, entropy in bits, and crack time at 10 billion guesses per second.
Free toolNo signupFormula shown
Saved & recent
CHECK ENTRYSAVED
RESULT
—
FORMULA USEDPassword Entropy Calculator
What password entropy means
Entropy measures how unpredictable a password is, in bits. The standard model treats a password as length × log2(pool size), where the pool is the sum of the character classes used: 26 lowercase, 26 uppercase, 10 digits, and 33 symbols. Each extra bit doubles the work an attacker must do.
The math, step by step
A 16-character random password over all four classes draws from 95 characters: pool = 26 + 26 + 10 + 33. Entropy = 16 × log2(95) ≈ 16 × 6.57 = 105 bits, meaning roughly 2 to the 105th power — forty billion trillion trillion — equally likely passwords. Crack time is that count divided by the attacker’s guessing speed.
Reading the rating bands
The thresholds follow standard guidance: below 28 bits is very weak, 28–36 weak, 36–60 reasonable, 60–128 strong, and beyond 128 bits very strong — the point where even nation-scale hardware needs longer than the age of the universe. Anything above 60 random bits is comfortably beyond offline attack; anything under 36 falls in hours.
Worked example
A randomly generated 16-character password using all four character classes.
At 10 billion guesses/second that is ≈ 1.4 × 10¹⁴ years — rated Strong.
How to use it
Enter the length of the password (or the one you are considering).
Toggle the character classes your generator or policy uses.
Read the entropy, pool size, and crack times at three attack speeds.
Aim for 60+ random bits — or 128+ for long-term secrets like encryption keys.
Frequently asked questions
What is password entropy?
It is a measure of unpredictability in bits, computed as length times the base-2 logarithm of the character pool size. More bits means exponentially more possible passwords an attacker must try.
How do you calculate password entropy?
Sum the character classes you use (26 + 26 + 10 + 33 = 95 for all four), take log2 of that pool, and multiply by password length. A 12-character, all-class password yields about 78.8 bits.
What is a secure password entropy in bits?
For everyday accounts, 60 or more random bits is strong, and 36–60 is merely reasonable. Long-term secrets such as encryption keys and master passwords deserve 100+ bits.
Is password length more important than character complexity?
Usually yes. Adding a random character from a 95-character pool adds 6.57 bits, while complexity rules push people into predictable patterns that entropy math does not capture. Length scales; patterns do not.
What character pool sizes are used for entropy?
The standard classes are 26 lowercase letters, 26 uppercase, 10 digits, and 33 printable symbols — 95 total across all four. Some calculators use a custom pool up to 256 for byte-oriented generators.
How does entropy relate to brute-force crack time?
Possible combinations equal 2 to the power of the entropy; crack time is that divided by guess speed. Every extra bit doubles the time, which is why 105 bits defeats hardware that shreds 40-bit passwords instantly.