Password Entropy Calculator
Entropy bits and crack time.
Reviewed by the Calculation Machine team · Updated 24 October 2026 · How we check our maths
Your values
ⓘ Live results
- Entropy
- 91.8 bits
- Time to crack
- 667497127 years
- Combinations
- 4.205e+27
- Rating
- Strong
Quick answer
Password entropy is length × log₂(character set size), measured in bits; each extra bit doubles the number of guesses an attacker needs. A random 14-character password using all 94 printable ASCII characters has about 91.8 bits of entropy. A random 8-character alphanumeric password has only 47.6 bits and could fall in minutes to a fast offline attack.
What the Password Entropy calculator does
This calculator measures the strength of a randomly generated password as entropy in bits, the total number of possible combinations, and the average time a brute-force attacker would need at a guess rate you choose. It also rates the result as weak, reasonable or strong.
Use it to decide how long a generated password or passphrase should be, to set a password policy, or to compare a short complex password with a longer simple one. The guess rate matters: a website that locks accounts after a few tries allows only a handful of guesses per second, while an attacker holding a stolen database of fast hashes can try billions per second.
The math only holds when every character is chosen at random. Human-chosen passwords like "Summer2024!" are far weaker than their length suggests, because attackers try dictionary words, names and common patterns first. The underlying counting is the same as in the combination calculator.
The formula
H = L × log₂(N) Combinations = N^L Average crack time = 2^(H − 1) ÷ guesses per second
| Symbol | Meaning | Unit |
|---|---|---|
| H | Entropy | bits |
| L | Password length | characters |
| N | Size of the character set each character is drawn from (26, 52, 62 or 94) | symbols |
| guesses per second | Attacker's guess rate; the default 10¹¹ models a well-equipped offline attack on a fast hash | guesses/s |
This is the Shannon entropy of a uniformly random string, the measure used in NIST SP 800-63 discussions of password strength. The average crack time uses half the search space, since on average an attacker finds the password halfway through. For passphrases, use words instead of characters: each word picked at random from the 7,776-word Diceware or EFF list adds log₂(7,776) ≈ 12.9 bits.
Worked examples
Short alphanumeric password
A random 8-character password using upper and lower case letters and digits, against an offline attacker at 100 billion guesses per second.
Inputs
- Password length8
- Character setAlphanumeric
- Guesses per second1e11
Result
- Entropy47.6 bits
- Time to crack1091.7 seconds
- Combinations2.183e+14
- RatingWeak
47.6 bits falls in about 18 minutes on average. Eight characters is no longer enough against offline attacks, even when every character is random.
Password manager default
A random 14-character password using all printable ASCII symbols, at the same offline guess rate.
Inputs
- Password length14
- Character setAll printable ASCII
- Guesses per second1e11
Result
- Entropy91.8 bits
- Time to crack667497127 years
- Combinations4.205e+27
- RatingStrong
About 92 bits takes hundreds of millions of years on average to brute-force. This is a sensible default for anything stored in a password manager.
Long lowercase password
A random 20-character password using only lowercase letters, which is easy to type on a phone, at 10 billion guesses per second.
Inputs
- Password length20
- Character setLowercase only
- Guesses per second1e10
Result
- Entropy94 bits
- Time to crack31631982373 years
- Combinations1.993e+28
- RatingStrong
94 bits beats the 14-character complex password. Length adds strength faster than extra symbol types do, which is why passphrases work well.
Entropy by length and character set
Bits of entropy for random passwords. As a rough guide, under about 60 bits is weak against offline attacks, 60–80 is reasonable and 80 or more is strong.
| Length | Lowercase (26) | Upper + lower (52) | Alphanumeric (62) | All ASCII (94) |
|---|---|---|---|---|
| 8 | 37.6 | 45.6 | 47.6 | 52.4 |
| 12 | 56.4 | 68.4 | 71.5 | 78.7 |
| 16 | 75.2 | 91.2 | 95.3 | 104.9 |
| 20 | 94.0 | 114.0 | 119.1 | 131.1 |
Choosing a realistic guess rate
- Online attack on a login page: rate limiting and lockouts usually hold attackers to well under 100 guesses per second, often far fewer.
- Offline attack on a slow hash (bcrypt, scrypt, Argon2): from thousands to perhaps millions of guesses per second, depending on the settings and hardware.
- Offline attack on a fast or unsalted hash (MD5, SHA-1, NTLM): GPU rigs reach billions to hundreds of billions per second. The default 10¹¹ models this worst case.
You cannot control how a website stores passwords, so plan for the worst case for anything important and use a unique password per site.
Passphrases and what current guidance recommends
Six words chosen at random from the 7,776-word Diceware or EFF list give about 77.5 bits — strong and far easier to remember than a jumble of symbols. The words must be picked randomly (dice or a generator), not chosen by you.
NIST's Digital Identity Guidelines (SP 800-63B) favor length over composition rules, recommend screening new passwords against lists of breached passwords, and advise against forcing periodic changes without evidence of compromise. Pair strong passwords with multi-factor authentication. For the probability side of guessing, see the probability calculator.
How to use the Password Entropy Calculator
- 1Enter the length of the password in characters.
- 2Choose the character set it was randomly generated from — all printable ASCII is 94 symbols including punctuation.
- 3Set the attacker's guesses per second: about 10 for an online login, 10¹¹ (the default) for a fast offline attack.
- 4Read the entropy, average time to crack and rating; increase length first if the result is weak.
Frequently asked questions
How many bits of entropy is a strong password?
About 80 bits or more resists offline attacks for the foreseeable future. Around 60–80 bits is reasonable for accounts protected by rate limiting and multi-factor authentication.
Is a longer password better than a complex one?
Usually. A random 20-character lowercase password has 94 bits, more than a random 14-character password using every symbol (91.8 bits).
How long would it take to crack an 8-character password?
A random 8-character alphanumeric password (47.6 bits) takes about 18 minutes on average at 100 billion guesses per second. Human-chosen 8-character passwords usually fall much faster.
Why does this calculator overrate my password?
It assumes every character was chosen at random. Real attacks test dictionary words, names, dates and substitutions like "P@ssw0rd" first, so memorable human-made passwords have far less entropy than the formula gives.
How strong is a four-word passphrase?
Four random words from a 7,776-word list give about 51.7 bits, similar to a random 9-character alphanumeric password. Use six words, about 77.5 bits, for important accounts.
References
- NIST SP 800-63B: Digital Identity Guidelines – Authentication and Lifecycle Management — US National Institute of Standards and Technology (NIST)
- EFF Dice-Generated Passphrases (Large Wordlist) — Electronic Frontier Foundation (EFF)
About this calculator
- Built and reviewed by the Calculation Machine team · How we build and test calculators
- Last reviewed: October 24, 2026
- Report an error