Free · Private · Client-side
Password Entropy Calculator
See entropy in bits and an estimated crack time as you change the length and character set, or type a password and the pool updates to match. Calculated in your browser.
Generated values never leave this device.Random string from this pool
104 bits
~23× the age of the universe to crack
In plain terms: a gaming PC guessing a million passwords per second would need 23 million times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 23× the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.
Pool size 94. E = 16 × log₂(94), rounded down.
The password stays in this browser. Moving the length or a checkbox switches the readout back to a random string of that size.
In plain terms: a gaming PC guessing a million passwords per second would need 23 million times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 23× the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.
Test common passwords
These are guesses, not random strings. The bit count is what the pool formula says — an attacker with a dictionary does not need that many tries.
How entropy is calculated
For a password whose characters are chosen independently and uniformly from a pool of size N, the Shannon entropy is E = L × log₂(N) bits, where L is the length. This page rounds that down with Math.floor, the same helper the other generators use.
The pools are lowercase 26, uppercase 26, digits 10, and 32 for any other non-space symbol. A space adds 1 only when you are measuring a password that contains one. Full mixed case, digits, and symbols is 94, so a random 16-character string is 104 bits.
Crack time takes half the keyspace, 2E−1 guesses, at 1012 guesses per second, and assumes the attacker knows N. It is not an estimate of how fast someone can guess “password” or a keyboard pattern. Those live in a much smaller list.
Frequently asked questions
How is password entropy calculated?
Entropy in bits is length times log base 2 of the pool size: E = L × log₂(N). N is 26 for lowercase, 26 for uppercase, 10 for digits, and 32 for other symbols. The result is rounded down to a whole number of bits. That is the entropy of a string drawn uniformly at random from that pool, not a guessability score for a phrase a person made up.
How accurate are the time-to-crack estimates?
Crack time assumes the attacker already knows the pool and tries half of it (2^(E−1) guesses) at one trillion guesses per second. It is an offline brute-force estimate. Rate limits, account lockouts, and a slow password hash such as bcrypt or Argon2 make an online or database attack much slower. A reused or phished password is not protected by this number.
Is a longer password always better than a complex one?
Length multiplies the exponent, so it usually adds more entropy than swapping in one more symbol class. A 20-character lowercase string is about 94 bits; a 12-character string from a 94-character pool is about 78 bits. Use both when the system allows it. A passphrase drawn from a large word list is a different pool — its entropy is word count times log₂ of the list size, not character length.
What about dictionary words and patterns?
This calculator assumes each character was chosen independently and uniformly from the selected pool. Dictionary words, keyboard walks, and predictable substitutions such as @ for a are not uniform, so the real chance an attacker guesses them is much higher than the bit count. Generate the password at random, or use a long passphrase, for accounts that matter.
How much entropy do I need?
For most online accounts, aim for at least 64 bits and turn on a second factor. High-value accounts are more comfortable at 80 bits or more. A master password or an encryption passphrase should be in the 128-bit range, because it may have to resist offline guessing. These are rules of thumb for random secrets, not for words you chose yourself.
Privacy