Estimate entropy, possible combinations, and brute-force time for a uniformly random password configuration.
📊 Random-password model only. This calculator assumes uniformly random character selection. Human-created passwords are typically far less random (predictable patterns, common words, repeated substitutions). Estimate uses 1e9 guesses/second as a single scenario. Actual attack rates, dictionary attacks, and breached-password databases can be much faster/slower.
Last updated: March 2026 | Security Tool
Password entropy measures the strength and unpredictability of a password. It's calculated as log₂(pool size ^ length), where "pool size" is the number of unique characters available and "length" is the number of characters in the password. Higher entropy means a stronger, harder-to-crack password.
According to current security standards, a password with 80+ bits of entropy is considered very strong and would take millions of years to crack using brute force. Passwords with 50-79 bits are moderate strength, while anything below 50 bits is considered weak. This calculator assumes an attacker can make 1 billion guesses per second.
Real-world security also depends on other factors beyond entropy, including whether the password is unique, how it's stored (salting and hashing), and whether it's protected against attacks like dictionary guesses or rainbow tables.
For most purposes, 70-80 bits is sufficient. For highly sensitive systems, aim for 100+ bits. Anything below 50 bits is considered weak and vulnerable to modern attacks.
Length has exponential impact on entropy. A 16-character all-lowercase password is stronger than an 8-character password with all character types.
Symbols increase pool size from 62 to 95 characters, adding about 5.6 bits of entropy per character. They help, but increasing length is usually more effective.
This calculator assumes random passwords. Dictionary words are much weaker because attackers use word lists, not brute force. Always use random characters or passphrases.
Yes, GPUs can make 1+ billion guesses per second offline. This assumes worst-case: password is hashed and stored locally without rate limiting.
No, this shows raw cracking time. Good password hashing (bcrypt, Argon2) makes cracking MUCH slower by design, providing additional protection.
This calculator is useful for estimating strength, but online accounts have rate limiting and lockouts that make cracking much harder. Never reuse passwords.
Passphrases can be very strong and memorable, but this calculator assumes random characters. For passphrases, use a different tool designed for word combinations.
Related Tools