Password Entropy Calculator
Calculate the entropy (bits of randomness) and estimated crack time of any password based on its character set and length.
Analyzed entirely in your browser — never sent to any server.
About Password Entropy Calculator
Password entropy measures unpredictability, in bits: each extra bit doubles the number of attempts an attacker needs. The textbook formula is length × log₂(charsetSize), and it is exactly right for a password a machine generated at random — but badly wrong for one a human chose. It has no way to know that Password1! is a top-ranked breach password wearing a digit and a symbol, so it awards it about 66 bits: more than a random 9-character string, and utterly wrong.
This calculator reports effective entropy instead. It searches for the cheapest description of your password out of common passwords, dictionary words, names, keyboard runs, sequences, repeated blocks, dates and letter-for-symbol substitutions, and brute-force arithmetic covers only what is left over. The bits you see are the base-2 logarithm of that guess count, so they are directly comparable across passwords — and the four attack scenarios show why the same number means "safe" behind a rate-limited login form and "already cracked" in a leaked hash dump. Because the built-in word lists are compact, an unusual word may still be treated as random, so read the figure as an upper bound.
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Seeing how much entropy a password's length and character set actually give.
- Comparing a long passphrase against a short complex string.
- Understanding why adding length beats adding symbols.
- Estimating a crack time under a stated guess rate.
- Making the case for a length policy over a composition one.
Frequently Asked Questions
- How is entropy calculated?
- log₂(charset size) × length, in bits. A 12-character password from the 95 printable ASCII characters is about 78 bits. That formula assumes every character was chosen uniformly at random, which is the assumption almost every human-chosen password violates.
- Why is a human-chosen password worth so much less than its entropy suggests?
- Because the formula measures the space, not the choice. `Password123!` scores well on length and charset and is in every cracking dictionary — real entropy is about the unpredictability of the selection process, and a person is not a uniform random source.
- How many bits are enough?
- Around 50 for something rate-limited, 80 or more for a hash that might be stolen and cracked offline. Modern GPUs test billions of candidates a second against fast hashes, which is why the offline case demands so much more than the online one.
- Is a passphrase better than a complex password?
- Usually, for the same memorability. Four random dictionary words from a 7,776-word list is about 51 bits and is far easier to remember than eleven random characters — the crucial word being random, since a chosen phrase is a chosen phrase.
- Why is the password kept out of the URL?
- Because URLs are logged everywhere — server logs, proxies, browser history, the Referer header sent to third parties. This tool deliberately keeps the value out of its own shareable link, which is a rule that has been applied across five tools here.
Common errors and gotchas
- Assuming the character set is the one you think, when a predictable pattern reduces the real entropy enormously.
- Reading a crack time as a prediction, when it depends entirely on how the password was stored.
- Computing entropy for a password based on a dictionary word, which the formula cannot see.
- Treating high entropy as sufficient when the password has been reused elsewhere.
- Typing a real password into any tool, which is a habit worth not forming.