Password Entropy Calculator
Calculate password entropy bits and estimate crack time
100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.
Enter a password above to see its entropy and crack time estimates.
About this tool
Password entropy measures, in bits, how unpredictable a password is based on its length and character variety - higher entropy means exponentially more possible combinations an attacker would need to try. This tool calculates a password's entropy and estimates roughly how long it would take to crack by brute force.
Lock down an account properly
- 1Generate a passwordLong and random beats clever.Open
- 2Check its strengthSee how long it would take to crack.Open
- 3Measure the entropyThe maths behind how guessable it really is.You are here
How to use this tool
- Enter test password patternUse representative password style to assess practical strength.
- Calculate entropy scoreMeasure effective unpredictability and estimated brute-force complexity.
- Review crack-time estimateInterpret model assumptions and identify weak structure patterns.
- Improve password strategyIncrease length/randomness or switch to generated passphrases/password manager.
How password entropy is calculated
For a random password, entropy = length x log2(size of the character set). A 12-character password from 94 printable characters has about 12 x 6.55 = 79 bits. Every extra bit doubles the number of guesses needed.
This only holds for truly random passwords. A password made from a word and a year has far less real entropy than the formula suggests, because attackers try those patterns first. Aim for 60 bits or more for online accounts and 80 or more for master passwords.
Key features
- Quantifies password strength beyond vague “strong/weak” labels.
- Highlights real impact of length and randomness choices.
- Useful for policy education and user-security training.
- Supports better password standard decisions.
Common uses
- Evaluating enterprise password policy quality.
- Teaching users why longer random credentials matter.
- Comparing passphrase vs symbol-heavy short passwords.
- Auditing generated credentials before account provisioning.
Tips for better results
- Prioritize longer length over cosmetic symbol substitutions.
- Use unique passwords per service with a password manager.
- Avoid dictionary patterns and predictable keyboard sequences.
- Treat crack-time estimates as guidance, not guaranteed safety.
Mistakes to avoid
- Believing complexity rules alone guarantee high entropy.
- Reusing high-entropy password across multiple accounts.
- Relying on memorable phrases with common word patterns.
- Ignoring MFA even with strong password entropy scores.
Frequently asked questions
Higher is better - many security guidelines suggest aiming for at least 60-80 bits of entropy for important accounts, though the practical threshold depends on what you're protecting and against what kind of attacker.
It's based on the total number of possible combinations (determined by entropy) divided by an assumed number of guesses an attacker could attempt per second - actual crack time in the real world also depends heavily on the specific system's security measures beyond just the password itself (like rate limiting).
Length is a major factor, but entropy also depends on unpredictability - a long but predictable password (like "passwordpasswordpassword") has much lower real-world entropy than its length alone would suggest, since attackers can exploit the pattern.
Far less than the formula suggests. 'Summer2026!' looks varied but follows a pattern attackers try early, so its real strength is low. Random generation is what makes the entropy figure honest.
Add length. Each extra random character or word multiplies the possibilities, so a longer passphrase gains more than swapping letters for symbols.
They depend on how the password is stored. A slow hash like bcrypt allows only thousands of guesses per second, while a leaked fast hash may allow billions - the same password can last centuries or minutes.