Password Entropy Calculator
No 'strong' verdict — a verdict needs a threat model.
Work out Password Entropy. No 'strong' verdict — a verdict needs a threat model. Names the misconception directly.
Entropy
71.5 bits
Resists offline attacks on slow hashes; a fast hash on modern GPUs is still a concern
Entropy assumes the password is chosen randomly from the character set. A twelve-character password built from a dictionary word with predictable substitutions has nowhere near the entropy this calculates, because an attacker does not guess randomly — they guess likely things first. There is no single crack time, which is why several are shown. Sixty bits is unbreakable against a rate-limited login and falls in hours to an offline attack on a fast hash. The same password, two completely different answers, and the difference is entirely the threat model. Length beats complexity. Adding one character to a lowercase-only password multiplies the search space by 26; adding symbols to a fixed-length one multiplies it by roughly 1.5 per character. That is the arithmetic behind long passphrases over short cryptic strings.
How the Password Entropy Calculator works
Entropy in bits and crack times at five different attack rates. There is no single strength verdict here, because sixty bits is unbreakable against a rate-limited login and falls in hours to an offline attack on a fast hash.
Also known as: how strong is my password · how long to crack this password · bits of entropy password · is a passphrase better
Frequently asked questions
What is password entropy?
The number of bits needed to describe the password, assuming it was chosen randomly from the character set. Each bit doubles the search space, so 60 bits is a billion times harder than 30.
Why is there no single crack time?
Because it depends entirely on how the attack happens. A rate-limited login allows perhaps 100 guesses a second; an offline attack on a fast hash allows a hundred billion. The same password, a factor of a billion apart.
Is length or complexity more important?
Length, decisively. Adding a character to a lowercase-only password multiplies the search space by 26; adding symbols to a fixed-length one multiplies it by roughly 1.5 per character.
Does this apply to passwords I made up?
No, and that is the important caveat. Entropy assumes random selection — a dictionary word with predictable substitutions has far less than the arithmetic suggests, because attackers guess likely things first.
What about a passphrase?
Four or five random words from a large list give 50 to 65 bits and are far easier to remember than an equivalent random string. The words must be genuinely random, not a phrase you thought of.
Put this calculator on your own site
Free to use, on any site, commercial or not. Paste this where you want it to appear. It is a plain iframe, so it works in WordPress, Squarespace, Wix, Webflow, Ghost and anything else that accepts HTML.
<iframe src="https://www.thecalclibrary.com/embed/password-entropy-calculator" width="100%" height="640" style="border:1px solid #e2e8f0;border-radius:12px" loading="lazy" title="Password Entropy Calculator"></iframe>
<p style="font:13px/1.5 system-ui,sans-serif;margin:6px 0 0;color:#64748b">Powered by <a href="https://www.thecalclibrary.com/password-entropy-calculator" style="color:#64748b">Password Entropy Calculator</a> from The Calc Library</p>The only condition is that the credit line below the frame stays in place. That one line is what pays for the tool being free — it is how anyone else finds it.