Password Strength Calculator
Estimate password entropy in bits from length and character set.
Results update as you type.
How it works
A password strength calculator estimates entropy, the mathematical measure of how unpredictable a password is, expressed in bits. Each bit doubles the number of guesses an attacker must try, so a password with 60 bits of entropy is over a thousand times harder to crack by brute force than one with 50 bits. This tool takes two inputs that drive entropy: the password length and the size of the character set it draws from. Understanding entropy helps you build passwords that resist modern cracking hardware, which can test billions of guesses per second. Length is the most powerful lever because it multiplies directly into the exponent, which is why a long passphrase of common words can outscore a short string of random symbols. The character set matters too: adding uppercase letters, digits, and symbols enlarges the pool each position is chosen from. The formula works because a random password of length L from a pool of N characters has N to the power L possible values, and the base-two logarithm of that count is the entropy in bits. This calculator assumes each character is chosen randomly and independently; predictable patterns, dictionary words, or reused passwords reduce real strength far below the theoretical figure. Security-minded users, developers setting password policies, and anyone auditing their credentials use an entropy calculator to judge password quality objectively.
entropy (bits) = length × log2(character set size)
Entropy measures how many yes-or-no questions an attacker would need to guess a password, and each character drawn from a pool of a given size adds log base two of that pool size in bits. Multiplying by the length adds that contribution once per character, because the choices are independent. A larger pool or a longer password both raise the exponent on the number of possible combinations, which is why both length and variety strengthen a password.
Source:Shannon entropy (information theory)
We review all our tools from time to time to ensure accuracy.
Worked example
How to use this calculator
- 1
Enter your values
Enter password length and character set.
- 2
Adjust the options
Fine-tune any options to match your situation.
- 3
Read your result
Entropy updates instantly as you type — no button to press.
Frequently asked questions
What is password entropy measured in bits?
Entropy in bits describes how unpredictable a password is, where each additional bit doubles the number of possible combinations an attacker must try. A password with 40 bits has about a trillion possibilities, while 80 bits has over a septillion. Higher entropy means exponentially more guessing effort. Because the scale is logarithmic, small increases in length or character variety produce large jumps in real-world cracking difficulty.
How many bits of entropy are safe?
As a rough guide, under 40 bits is weak and crackable quickly, 40 to 60 is fair but vulnerable to determined attackers, 60 to 80 is strong for most purposes, and above 80 bits is very strong against brute force with current hardware. For sensitive accounts, aim for 80 bits or more. Remember these figures assume truly random characters, so patterns and reuse lower actual strength.
Does a longer password beat a more complex one?
Usually yes. Because length multiplies directly into the entropy, adding characters raises strength faster than switching to a larger symbol set. A long passphrase of several random words can exceed the entropy of a short string of mixed symbols while being far easier to remember. This is why security guidance increasingly favours length, encouraging passphrases over cryptic but short passwords that are hard to recall.
Why does the character set size matter?
The character set is the pool each position is chosen from, and a larger pool means each character carries more entropy. Lowercase letters alone give 26 options, adding uppercase reaches 52, adding digits reaches 62, and adding symbols reaches around 95. Enlarging the set raises the base of the exponent, so every character contributes more bits. Combined with length, it determines the total unpredictability of the password.
Does this account for dictionary attacks?
No, the entropy figure assumes every character is chosen randomly and independently. Real passwords built from dictionary words, names, dates, or predictable substitutions are far weaker than their length suggests, because attackers try likely patterns first. Treat the result as an upper bound that applies only to genuinely random passwords. For real security, use a password manager to generate random strings rather than inventing memorable but guessable ones.