{"success":true,"version":"v1","request":{"tool":"get_calculator_schema","calculator_id":"password-entropy"},"result":{"entity_type":"calculator","id":"password-entropy","calculator_id":"password-entropy","canonical_url":"https://tttkmbb.com/everyday/password-entropy","name":"Password Entropy Calculator","title":"Password Entropy Calculator – Bits of Entropy and Brute-Force Crack Time from Length and Character Sets","category":"everyday","category_name":"Everyday Life","tool_name":"estimate_password_entropy","featured_mcp_tool":false,"description":"Computes the entropy of a randomly generated password from its length and the character classes it draws on (charset size 26/52/62/95), the number of possible combinations and the average time to brute-force it at 10⁴, 10⁹ and 10¹² guesses per second; the password itself is never entered.","use_when":"You are choosing a password-generator policy, comparing password lengths and character sets, or explaining why length matters more than symbols.","do_not_use_when":"You want to rate a password a person chose (dictionary words, names and patterns make it far weaker than this uniform-random model), or you need a passphrase word count (compute bits as words × log2 of the word-list size).","inputs":[{"name":"length","label":"Password length","type":"integer","unit":"characters","required":true,"min":1,"max":256,"description":"Number of characters.","example":12},{"name":"lowercase","label":"Lowercase letters (26)","type":"boolean","required":false,"default":true,"description":"Include a–z.","example":true},{"name":"uppercase","label":"Uppercase letters (26)","type":"boolean","required":false,"default":true,"description":"Include A–Z.","example":true},{"name":"digits","label":"Digits (10)","type":"boolean","required":false,"default":true,"description":"Include 0–9.","example":true},{"name":"symbols","label":"Symbols (33)","type":"boolean","required":false,"default":false,"description":"Include the 32 printable ASCII punctuation characters and space.","example":true}],"outputs":[{"name":"charset_size","label":"Character set size","type":"integer","decimals":4,"description":"Number of distinct characters available."},{"name":"entropy_bits","label":"Entropy","type":"number","unit":"bits","decimals":1,"description":"length × log2(charset_size)."},{"name":"combinations","label":"Possible passwords","type":"number","decimals":0,"description":"charset_size ^ length."},{"name":"combinations_text","label":"Possible passwords","type":"string","decimals":4,"description":"Same number in scientific notation."},{"name":"crack_seconds_1e4","label":"Average crack time at 10⁴ guesses/s","type":"number","unit":"s","decimals":2,"description":"Online attack against a rate-limited service."},{"name":"crack_time_1e4","label":"Crack time at 10⁴/s","type":"string","decimals":4,"description":"Human-readable form."},{"name":"crack_seconds_1e9","label":"Average crack time at 10⁹ guesses/s","type":"number","unit":"s","decimals":2,"description":"Offline attack on a slow hash (bcrypt/scrypt/Argon2) or a single GPU on a fast hash."},{"name":"crack_time_1e9","label":"Crack time at 10⁹/s","type":"string","decimals":4,"description":"Human-readable form."},{"name":"crack_seconds_1e12","label":"Average crack time at 10¹² guesses/s","type":"number","unit":"s","decimals":2,"description":"Offline attack with a GPU cluster on a fast unsalted hash (MD5, NTLM)."},{"name":"crack_time_1e12","label":"Crack time at 10¹²/s","type":"string","decimals":4,"description":"Human-readable form."},{"name":"strength","label":"Strength","type":"string","decimals":4,"description":"Very weak (<40 bits), weak (40–59), moderate (60–74), strong (75–99) or very strong (100+)."}],"input_schema":{"type":"object","properties":{"length":{"description":"Number of characters. Unit: characters.","type":"integer","minimum":1,"maximum":256,"examples":[12],"x-unit":"characters"},"lowercase":{"description":"Include a–z.","type":"boolean","default":true,"examples":[true]},"uppercase":{"description":"Include A–Z.","type":"boolean","default":true,"examples":[true]},"digits":{"description":"Include 0–9.","type":"boolean","default":true,"examples":[true]},"symbols":{"description":"Include the 32 printable ASCII punctuation characters and space.","type":"boolean","default":false,"examples":[true]}},"additionalProperties":false,"required":["length"]},"output_schema":{"type":"object","properties":{"charset_size":{"description":"Number of distinct characters available.","type":"integer"},"entropy_bits":{"description":"length × log2(charset_size). Unit: bits.","type":"number","x-unit":"bits"},"combinations":{"description":"charset_size ^ length.","type":"number"},"combinations_text":{"description":"Same number in scientific notation.","type":"string"},"crack_seconds_1e4":{"description":"Online attack against a rate-limited service. Unit: s.","type":"number","x-unit":"s"},"crack_time_1e4":{"description":"Human-readable form.","type":"string"},"crack_seconds_1e9":{"description":"Offline attack on a slow hash (bcrypt/scrypt/Argon2) or a single GPU on a fast hash. Unit: s.","type":"number","x-unit":"s"},"crack_time_1e9":{"description":"Human-readable form.","type":"string"},"crack_seconds_1e12":{"description":"Offline attack with a GPU cluster on a fast unsalted hash (MD5, NTLM). Unit: s.","type":"number","x-unit":"s"},"crack_time_1e12":{"description":"Human-readable form.","type":"string"},"strength":{"description":"Very weak (<40 bits), weak (40–59), moderate (60–74), strong (75–99) or very strong (100+).","type":"string"}}},"formula":"charset = 26·lowercase + 26·uppercase + 10·digits + 33·symbols; entropy_bits = length × log2(charset); combinations = charset^length; average crack seconds = combinations / 2 / guesses_per_second","method":"Assumes every character is chosen uniformly at random, so entropy is the information content of the generator, not of a memorised password; human-chosen passwords typically carry 20–30 bits however long they are. The average attacker succeeds after half the key space; the strength bands are a common convention, not a standard.","sources":[{"name":"NIST SP 800-63B – Digital Identity Guidelines: Authentication and Lifecycle Management (Appendix A, strength of memorized secrets)","url":"https://pages.nist.gov/800-63-3/sp800-63b.html","type":"standard","retrieved_at":"2026-09-24"},{"name":"Password strength – entropy as a measure (Wikipedia)","url":"https://en.wikipedia.org/wiki/Password_strength","type":"reference","retrieved_at":"2026-09-24"}],"freshness":{"type":"static","max_age_seconds":null,"note":"Deterministic formula with fixed constants; results never go stale. Inputs supplied by the caller determine the output."},"examples":[{"name":"12 characters, all four classes","inputs":{"length":12,"lowercase":true,"uppercase":true,"digits":true,"symbols":true},"expected":{"charset_size":95,"entropy_bits":78.8,"combinations":5.4036e+23,"combinations_text":"5.40 × 10^23","crack_seconds_1e9":270180000000000,"crack_time_1e9":"8.56 million years","crack_time_1e12":"8,561 years","crack_time_1e4":"856 billion years","strength":"Strong"},"url":"https://tttkmbb.com/api/v1/calculate/password-entropy?length=12&lowercase=true&uppercase=true&digits=true&symbols=true"},{"name":"8 lowercase letters","inputs":{"length":8,"lowercase":true,"uppercase":false,"digits":false,"symbols":false},"expected":{"charset_size":26,"entropy_bits":37.6,"combinations":208827064576,"crack_seconds_1e9":104.41,"crack_time_1e9":"1.7 minutes","crack_time_1e12":"less than a second","crack_time_1e4":"121 days","strength":"Very weak"},"url":"https://tttkmbb.com/api/v1/calculate/password-entropy?length=8&lowercase=true&uppercase=false&digits=false&symbols=false"}],"faq":[{"q":"Is a longer password with fewer symbols better?","a":"Usually yes: each extra character multiplies the key space by the charset size, so 16 lowercase letters (75 bits) beat 10 mixed characters with symbols (66 bits)."},{"q":"Why not enter my actual password?","a":"A calculator cannot know your password's real randomness, and typing it into a web tool is a security risk. Estimate from the policy your generator uses instead."},{"q":"How many bits are enough?","a":"For online logins with rate limiting 40–50 bits suffices; for offline attacks on stored hashes aim for 75+ bits, and 100+ for encryption keys or passphrases protecting long-lived secrets."}],"tags":["password entropy","password strength calculator","bits of entropy","brute force time","how long to crack a password"],"related":[{"calculator_id":"exponent","reason":"Key space is charset raised to the length."},{"calculator_id":"combinations-permutations","reason":"Counting arrangements in general."},{"calculator_id":"logarithm","reason":"Entropy per character is log2 of the charset size."}],"links":{"html":"https://tttkmbb.com/everyday/password-entropy","markdown":"https://tttkmbb.com/everyday/password-entropy.md","json":"https://tttkmbb.com/everyday/password-entropy.json","api":"https://tttkmbb.com/api/v1/calculate/password-entropy","schema":"https://tttkmbb.com/api/v1/calculators/password-entropy","openapi":"https://tttkmbb.com/openapi.json","mcp":"https://tttkmbb.com/mcp"},"version":"v1","updated_at":"2026-09-24"},"timestamp":"2026-09-24T01:47:51Z"}