Password Entropy Calculator
Measure password strength in bits of entropy.
Results update as you type.
How it works
Password entropy measures how hard a password is to guess, expressed in bits, and this calculator computes it from the length and the character set. You enter the number of characters in the password and choose the character set it draws from, such as lowercase only or the full set of printable symbols, and it returns the entropy in bits along with the total number of possible combinations as a power of ten. Entropy works on a simple principle: each position in the password can be any of the characters in the set, so the number of possible passwords is the set size raised to the length, and entropy is the base-2 logarithm of that, giving bits. Each extra bit doubles the guessing effort, so entropy grows with both a longer password and a larger character set, though length has a stronger effect. As a rough guide, under 40 bits is weak, 60 to 80 bits is reasonable for most accounts, and over 100 bits is very strong. Crucially, entropy assumes a truly random password; real passwords built from words, names, or patterns are far weaker than their length suggests because attackers use dictionaries and rules. Use this to compare password schemes and understand why length and randomness matter. Enter your password length and character set to compute the entropy.
Entropy = length × log₂(character set size)
Password entropy in bits equals the password length multiplied by the base-2 logarithm of the number of possible characters at each position. Each additional bit doubles the number of possible passwords, so higher entropy means exponentially harder to guess. The combinations figure is the total number of possible passwords, shown as a power of ten.
Source:Information security
We review all our tools from time to time to ensure accuracy.
Worked example
How to use this calculator
- 1
Enter your values
Enter password length and character set.
- 2
Adjust the options
Fine-tune any options to match your situation.
- 3
Read your result
Entropy updates instantly as you type — no button to press.
Frequently asked questions
What is password entropy?
Password entropy measures how unpredictable a password is, in bits. It equals the length times the base-2 logarithm of the character set size. Higher entropy means exponentially more possible passwords and greater resistance to guessing. It assumes the password is randomly generated; predictable passwords have far less effective entropy than the formula suggests.
How many bits of entropy is secure?
As a rough guide, under 40 bits is weak and quickly cracked, 60 to 80 bits is reasonable for most accounts, and over 100 bits is very strong, suitable for high-value secrets. The right target depends on the threat, but longer, random passwords with large character sets easily reach strong levels.
Does length or character set matter more?
Both increase entropy, but length has a stronger, compounding effect because entropy grows linearly with length while it grows only with the logarithm of the character set. Adding characters to the set helps, but making a password a few characters longer usually adds more entropy, which is why long passphrases can be very strong.
Why do real passwords have less entropy than calculated?
The formula assumes every character is chosen randomly and independently. Real passwords based on words, names, dates, or keyboard patterns are highly predictable, so attackers using dictionaries and rules crack them far faster than the raw entropy implies. A random password reaches its full calculated entropy; a human-chosen one usually does not.
How does entropy relate to cracking time?
Higher entropy means exponentially more guesses are needed. Each additional bit doubles the number of possible passwords and thus the average guessing time. At a fixed guessing rate, a 70-bit password takes vastly longer to crack than a 40-bit one. Entropy is the clearest single measure of resistance to brute-force guessing.