Password entropy calculator
Measure a password in bits, two ways: the textbook formula most calculators use, and a realistic estimate that accounts for the patterns attackers try first.
Length vs complexity
Pick a length and a character set. We work out how long a plain lowercase password would need to be to match it.
Going from lowercase to all 94 symbols is worth the same as adding about 4 lowercase characters at this length. You get the complexity bonus once; length keeps paying.
What the bits actually mean
Entropy is a count of doublings. A password with 30 bits sits somewhere among about a billion (230) equally likely options; 31 bits doubles that. So 60 bits isn't twice as strong as 30, it's a billion times stronger.
The catch is that entropy describes how a password was made, not the string itself. Tr0ub4dor&3 scores around 72 bits on the textbook formula because it mixes all four character types. But it's really a dictionary word with common swaps and a digit: zxcvbn-ts prices it in the low 30s. A passphrase from the diceware generator is the opposite: all lowercase, yet each word is a true 12.9-bit random draw.
Doubling runs away from intuition faster than almost anything. Fancy a gentler puzzle with no attacker in it? ahaboo has a narrated explainer on why the Moon has phases.
For a random password the formula is exact, and the crack time calculator turns bits into time.
Entropy FAQ
What is password entropy?
Entropy measures how unpredictable a password is, in bits. Each bit doubles the number of guesses an attacker needs: 40 bits means about a trillion possibilities, 80 bits about a trillion trillion. It is only meaningful for the process that produced the password, not for the string alone.
How do you calculate password entropy?
For a password chosen uniformly at random, entropy = length × log2(size of the character set). A random 12-character password from the 94 printable ASCII characters has 12 × 6.55 ≈ 78.7 bits. For a passphrase, it is number of words × log2(size of the word list).
Why do you show two entropy numbers?
The textbook figure assumes every character was picked at random. Humans don’t pick that way, so we also show an estimate from zxcvbn-ts, which recognises dictionary words, names, dates and keyboard patterns. For Password1! the textbook figure is about 66 bits; the realistic one is under 10.
How many bits of entropy is enough?
As a rough guide for random passwords: under 40 bits is weak against offline attacks, 60–80 bits is strong for most accounts, and 100+ bits is beyond any foreseeable brute-force effort. Online accounts with proper rate limiting need much less, which is why NIST sets an 8-character minimum.
Is length or complexity more important?
Length, for the same effort. Adding symbols to a lowercase password raises bits per character from 4.7 to 6.55, a one-time gain of about 40%. Every extra character adds the full per-character amount again. Use the toggle on this page to compare.