Password Entropy Calculator

Password entropy measures how hard a password is to guess, in bits. A password with H bits of entropy takes an attacker about 2^(H-1) guesses on average, so every extra bit doubles the work. For a randomly generated password, H = L × log₂(C), where L is the length and C is the size of the character pool. For example, 64 bits means 2^64 (about 18.4 quintillion) possible passwords.

As a rough guide for randomly generated passwords: 60+ bits for basic online accounts, 80+ bits for sensitive accounts like email or social media, and 100+ bits for financial services, password managers, or any high-value data. Entropy above 128 bits is out of reach of any known attack, even with nation-state resources.

It counts which character types appear: lowercase letters (26), uppercase letters (26), digits (10), ASCII symbols and space (33), and other Unicode characters such as accents or emoji (estimated at 100). Those add up to the pool size C, and the theoretical entropy is L × log₂(C), counting characters rather than bytes. It then looks for things that make a password easier to guess than that formula suggests, such as very common passwords, simple variations like Password123!, repeated characters, sequences like abcd or 1234, keyboard runs like qwerty, and phrases of ordinary words, and lowers the estimate when it finds them. Everything runs locally in your browser.

That formula is only correct when every character is chosen at random. If the calculator finds a pattern an attacker would try first, it shows the lower, estimated entropy and lists the reason. For example, Password123! has a theoretical 78.8 bits, but it is a common password with a predictable ending, so its estimate is only about 24 bits. The theoretical figure is always shown next to the estimate.

A bigger pool helps: lowercase only = 26, plus uppercase = 52, plus digits = 62, plus symbols = 95. Length helps even more. Twelve random characters from all 95 give about 79 bits, and 17 random lowercase letters give about 80 bits. Both figures apply only to randomly generated passwords, so a password manager or generator is the easiest way to get them.

Yes. For random passwords, entropy depends only on the length and the pool, so 8 random characters from the full 95-character set (about 52.6 bits) are about as strong as 11 random lowercase letters (about 51.7 bits). A password you made up is different: P@55w0rd has the same 52.6-bit theoretical score, but it is a leetspeak version of one of the most common passwords, so the calculator rates it far lower.

Each estimate is the average time to guess a password with that much entropy (half the search space) in three illustrative scenarios: an online attack on a rate-limited login (about 100 guesses per second), an offline attack on a slow password hash such as bcrypt or Argon2 (about 10,000 guesses per second), and an offline attack on a fast hash such as MD5 or NTLM with GPU hardware (about 100 billion guesses per second). Real speeds vary a lot with the hash and the hardware, so treat them as rough illustrations. Assume passwords can be stolen in a data breach, where offline cracking applies.

Only partly. It checks a small built-in list of about 130 very common passwords, not a full breach database, and it cannot recognize every word, name or date. A phrase of several ordinary words is estimated by word count (about 12.9 bits per word, assuming words picked at random from a 7,776-word list) instead of letter count. Passwords built from words, names or dates you chose yourself can still be weaker than shown. For memorable passwords, use random words from a list, as our passphrase generator does.

No. All calculations run locally in your browser using JavaScript. Your password is not stored, logged, or sent over the network. As a general habit with any website, though, it is wise to test a password similar to your real one instead of the real one itself.