Home › Everyday Life › Password Entropy Calculator

Password Entropy Calculator

Q: Is a longer password with fewer symbols better?

Usually yes: each extra character multiplies the key space by the charset size, so 16 lowercase letters (75 bits) beat 10 mixed characters with symbols (66 bits).

Q: Why not enter my actual password?

A calculator cannot know your password's real randomness, and typing it into a web tool is a security risk. Estimate from the policy your generator uses instead.

Q: How many bits are enough?

For online logins with rate limiting 40–50 bits suffices; for offline attacks on stored hashes aim for 75+ bits, and 100+ for encryption keys or passphrases protecting long-lived secrets.

Computes the entropy of a randomly generated password from its length and the character classes it draws on (charset size 26/52/62/95), the number of possible combinations and the average time to brute-force it at 10⁴, 10⁹ and 10¹² guesses per second; the password itself is never entered.

When to use

You are choosing a password-generator policy, comparing password lengths and character sets, or explaining why length matters more than symbols.

Do not use when: You want to rate a password a person chose (dictionary words, names and patterns make it far weaker than this uniform-random model), or you need a passphrase word count (compute bits as words × log2 of the word-list size).

Formula

charset = 26·lowercase + 26·uppercase + 10·digits + 33·symbols; entropy_bits = length × log2(charset); combinations = charset^length; average crack seconds = combinations / 2 / guesses_per_second

Assumes every character is chosen uniformly at random, so entropy is the information content of the generator, not of a memorised password; human-chosen passwords typically carry 20–30 bits however long they are. The average attacker succeeds after half the key space; the strength bands are a common convention, not a standard.

Inputs

Parameter	Type	Unit	Required	Description
`length`	integer	characters	yes	Number of characters. Range: ≥ 1, ≤ 256
`lowercase`	boolean		default true	Include a–z.
`uppercase`	boolean		default true	Include A–Z.
`digits`	boolean		default true	Include 0–9.
`symbols`	boolean		default false	Include the 32 printable ASCII punctuation characters and space.

Outputs

Output	Type	Unit	Description
`charset_size`	integer		Number of distinct characters available.
`entropy_bits`	number	bits	length × log2(charset_size).
`combinations`	number		charset_size ^ length.
`combinations_text`	string		Same number in scientific notation.
`crack_seconds_1e4`	number	s	Online attack against a rate-limited service.
`crack_time_1e4`	string		Human-readable form.
`crack_seconds_1e9`	number	s	Offline attack on a slow hash (bcrypt/scrypt/Argon2) or a single GPU on a fast hash.
`crack_time_1e9`	string		Human-readable form.
`crack_seconds_1e12`	number	s	Offline attack with a GPU cluster on a fast unsalted hash (MD5, NTLM).
`crack_time_1e12`	string		Human-readable form.
`strength`	string		Very weak (<40 bits), weak (40–59), moderate (60–74), strong (75–99) or very strong (100+).

Example

12 characters, all four classes: {"length":12,"lowercase":true,"uppercase":true,"digits":true,"symbols":true} → {"charset_size":95,"entropy_bits":78.8,"combinations":5.4036e+23,"combinations_text":"5.40 × 10^23","crack_seconds_1e9":270180000000000,"crack_time_1e9":"8.56 million years","crack_time_1e12":"8,561 years","crack_time_1e4":"856 billion years","strength":"Strong"}

8 lowercase letters: {"length":8,"lowercase":true,"uppercase":false,"digits":false,"symbols":false} → {"charset_size":26,"entropy_bits":37.6,"combinations":208827064576,"crack_seconds_1e9":104.41,"crack_time_1e9":"1.7 minutes","crack_time_1e12":"less than a second","crack_time_1e4":"121 days","strength":"Very weak"}

GET https://tttkmbb.com/api/v1/calculate/password-entropy?length=12&lowercase=true&uppercase=true&digits=true&symbols=true

Machine access

API: GET https://tttkmbb.com/api/v1/calculate/password-entropy (query parameters) or POST with a JSON body {"inputs": {...}}
Schema: https://tttkmbb.com/api/v1/calculators/password-entropy · Markdown: https://tttkmbb.com/everyday/password-entropy.md · JSON definition: https://tttkmbb.com/everyday/password-entropy.json
MCP: server https://tttkmbb.com/mcp, tool run_calculator with calculator_id="password-entropy"
OpenAPI operationId: estimate_password_entropy
Freshness: static. Authentication: none. Rate limit: fair use (see rate limits).

Sources

FAQ

Is a longer password with fewer symbols better?

Usually yes: each extra character multiplies the key space by the charset size, so 16 lowercase letters (75 bits) beat 10 mixed characters with symbols (66 bits).

Why not enter my actual password?

A calculator cannot know your password's real randomness, and typing it into a web tool is a security risk. Estimate from the policy your generator uses instead.

How many bits are enough?

For online logins with rate limiting 40–50 bits suffices; for offline attacks on stored hashes aim for 75+ bits, and 100+ for encryption keys or passphrases protecting long-lived secrets.

Related calculators

Exponent Calculator — Key space is charset raised to the length.
Combinations and Permutations Calculator — Counting arrangements in general.
Logarithm Calculator — Entropy per character is log2 of the charset size.