Shiklo Tools
PDF40
Image20
Calculators & Converters25
Text & Writing13
Developer26
Video14
Audio14
Document14
Data & Spreadsheet12
Web & SEO9
OCR & Scanning5
Archive & File12
Security & Privacy23
Health & Medical29
QR & Barcode5

Password Entropy Calculator

Calculate the entropy in bits of a random password, passphrase or PIN, the number of combinations and how long it would take to guess.

Choose how a password is made, random characters, a passphrase of random words or a PIN, and its length, and the calculator shows its entropy in bits, the number of possible combinations, and how long an attacker would need on average to guess it at four typical speeds, from a rate-limited login page to a password-cracking rig. A second table shows how long a password must be to reach common strength targets.

You can also type a password to measure it by the character types it uses. That number is only meaningful for passwords made by a generator; for passwords people choose themselves, use the Password Strength Checker, which recognises words and patterns.

How to use Password Entropy Calculator

  1. Choose random characters, passphrase, PIN, or measure a password.
  2. Set the length and the character types, or the number of words and the word list.
  3. Read the entropy, the combinations and the time to guess.
  4. Use the target table to pick a safe length.

Features

  • Entropy in bits for passwords, passphrases and PINs
  • Number of possible combinations
  • Average time to guess at four attack speeds
  • Length needed for 40, 60, 80 and 128 bits
  • EFF, Diceware and BIP-39 word lists
  • Runs in your browser; nothing is sent

How entropy is calculated

If every character is picked at random from a pool of N possible characters, each one adds log2(N) bits, so a password of length L has L × log2(N) bits of entropy and 2 to the power of that many possible values. A passphrase works the same way with words: each word from the 7,776-word EFF or Diceware list adds about 12.9 bits. Every extra bit doubles the work for an attacker.

PasswordEntropyAverage time to guess at 10 billion per second
8 lowercase letters37.6 bitsabout 10 seconds
8 letters and digits47.6 bitsabout 3 hours
4 random words (EFF)51.7 bitsabout 2 days
6 random words (EFF)77.5 bitsabout 350 thousand years
12 characters, all types78.7 bitsabout 754 thousand years
16 characters, all types104.9 bitsthousands of times the age of the universe

Which attack speed applies?

How fast an attacker can guess depends on where the password is used. A website that limits login attempts allows only a few guesses an hour, so even 30 to 40 bits hold up there. The real danger is a stolen password database: attackers then guess offline at full speed. If the site stored passwords with a slow hash such as bcrypt, scrypt or Argon2, a single computer manages thousands of guesses a second; with a fast hash such as MD5 or SHA-1, a graphics-card rig can try tens of billions a second. The four speeds in the table are the standard scenarios used by the zxcvbn estimator.

Why entropy can mislead

The formula assumes the password was chosen at random. Human passwords are not: Summer2024! uses all four character types and would score about 72 bits by the formula, but attackers try season names, years and a trailing symbol early, so it falls in seconds. That is why the Measure option here only reports the formula and points to the Password Strength Checker, which estimates guesses the way attackers make them. To get the entropy shown, let a generator choose for you.

How much is enough?

For most online accounts, about 60 bits is plenty if the site uses a slow hash, and 80 bits or more protects you even if it does not. Password manager master passwords and disk encryption passphrases deserve 80 to 100 bits, because they are attacked offline. Encryption keys use 128 bits or more. In practice that means 16 random characters, or a passphrase of six or seven random words, which is easier to type and remember. Use a different password for every site, so one leak cannot unlock the others.

Frequently asked questions

What is password entropy?

A measure of how unpredictable a randomly generated password is, in bits. Each bit doubles the number of guesses an attacker needs.

How many bits of entropy is a strong password?

About 60 bits for ordinary accounts and 80 or more for master passwords and encryption. 16 random characters give about 105 bits.

How much entropy does a passphrase have?

About 12.9 bits per word from the 7,776-word EFF or Diceware list, so six words give about 77.5 bits.

Why does my own password score high here but weak in the strength checker?

Entropy assumes randomness. Chosen passwords follow patterns attackers know, so the strength checker, which looks for words and patterns, is the better guide.

How long would it take to crack my password?

It depends on the attack. The calculator shows the average time at four speeds, from 100 guesses an hour to 10 billion a second.

Is the password I type sent anywhere?

No. It is measured in your browser and never stored or sent.

Related tools