Password Entropy Calculator
The password entropy calculator measures how hard a password is to guess by working out its entropy in bits, the standard way security professionals describe strength. Entropy depends on two things, how long the password is and how large the pool of possible characters is, so a long password drawn from a mix of cases, digits and symbols scores far higher than a short word. The tool inspects your password, counts which character types it uses, lowercase, uppercase, digits and symbols, and adds up the size of that combined pool. It then multiplies the length by the base two logarithm of the pool size to give the entropy in bits, where each extra bit doubles the number of guesses an attacker would need. Alongside the bit count you get a plain strength rating and a rough estimate of how long a fast offline attack at ten billion guesses a second would take on average, which turns an abstract number into something you can feel. Anyone choosing a password for email, banking or a work login can use it to sanity check a choice before committing to it. A few habits make a real difference. Favour length over complexity, because adding characters raises entropy faster than swapping a letter for a symbol. Use a passphrase of several unrelated words, or let a password manager generate a long random string. Never reuse a strong password across sites, since one breach then exposes them all. This tool runs entirely in your browser and the password you type is never sent anywhere, but you should still avoid pasting a real password you currently use into any website.
Entropy = length x log2(character pool size). Crack time assumes ten billion guesses a second, on average. Rough guide only, not a security guarantee.
How it works
The tool counts how many character types your password uses and adds their sizes to get the pool, where lowercase and uppercase are 26 each, digits are 10 and symbols are 33. It multiplies the password length by the base two logarithm of that pool to get the entropy in bits, then converts the bits into an average crack time at ten billion guesses a second.
Worked example
The password Tr0ub4dour has 10 characters using lowercase, uppercase and digits, a pool of 62. Ten times log2 of 62 is about 59.5 bits, which rates as Reasonable, and the average crack time works out near 1 year.
Related calculators
- UUID v4 Generator: random unique IDs.
- Slug Generator: make URL slugs.
- URL Encoder / Decoder: escape URL text.