# Password Entropy Calculator

> Computes the entropy of a randomly generated password from its length and the character classes it draws on (charset size 26/52/62/95), the number of possible combinations and the average time to brute-force it at 10⁴, 10⁹ and 10¹² guesses per second; the password itself is never entered.

- Calculator id: `password-entropy` · Category: Everyday Life (`everyday`) · Tool name: `estimate_password_entropy`
- Canonical page: https://tttkmbb.com/everyday/password-entropy · This document: https://tttkmbb.com/everyday/password-entropy.md · JSON definition: https://tttkmbb.com/everyday/password-entropy.json

## Purpose

Computes the entropy of a randomly generated password from its length and the character classes it draws on (charset size 26/52/62/95), the number of possible combinations and the average time to brute-force it at 10⁴, 10⁹ and 10¹² guesses per second; the password itself is never entered.

**Use when:** You are choosing a password-generator policy, comparing password lengths and character sets, or explaining why length matters more than symbols.

**Do not use when:** You want to rate a password a person chose (dictionary words, names and patterns make it far weaker than this uniform-random model), or you need a passphrase word count (compute bits as words × log2 of the word-list size).

## Input

| Parameter | Type | Unit | Required | Description |
| --- | --- | --- | --- | --- |
| `length` | integer | characters | required | Number of characters. (min 1, max 256) |
| `lowercase` | boolean |  | optional, default true | Include a–z. |
| `uppercase` | boolean |  | optional, default true | Include A–Z. |
| `digits` | boolean |  | optional, default true | Include 0–9. |
| `symbols` | boolean |  | optional, default false | Include the 32 printable ASCII punctuation characters and space. |

## Output

| Field | Type | Unit | Description |
| --- | --- | --- | --- |
| `charset_size` | integer |  | Number of distinct characters available. |
| `entropy_bits` | number | bits | length × log2(charset_size). |
| `combinations` | number |  | charset_size ^ length. |
| `combinations_text` | string |  | Same number in scientific notation. |
| `crack_seconds_1e4` | number | s | Online attack against a rate-limited service. |
| `crack_time_1e4` | string |  | Human-readable form. |
| `crack_seconds_1e9` | number | s | Offline attack on a slow hash (bcrypt/scrypt/Argon2) or a single GPU on a fast hash. |
| `crack_time_1e9` | string |  | Human-readable form. |
| `crack_seconds_1e12` | number | s | Offline attack with a GPU cluster on a fast unsalted hash (MD5, NTLM). |
| `crack_time_1e12` | string |  | Human-readable form. |
| `strength` | string |  | Very weak (<40 bits), weak (40–59), moderate (60–74), strong (75–99) or very strong (100+). |

## Formula

`charset = 26·lowercase + 26·uppercase + 10·digits + 33·symbols; entropy_bits = length × log2(charset); combinations = charset^length; average crack seconds = combinations / 2 / guesses_per_second`

Assumes every character is chosen uniformly at random, so entropy is the information content of the generator, not of a memorised password; human-chosen passwords typically carry 20–30 bits however long they are. The average attacker succeeds after half the key space; the strength bands are a common convention, not a standard.

## Data Sources

- NIST SP 800-63B – Digital Identity Guidelines: Authentication and Lifecycle Management (Appendix A, strength of memorized secrets) — https://pages.nist.gov/800-63-3/sp800-63b.html (standard, retrieved 2026-09-24)
- Password strength – entropy as a measure (Wikipedia) — https://en.wikipedia.org/wiki/Password_strength (reference, retrieved 2026-09-24)

Data freshness: `static`. Deterministic formula with fixed constants; results never go stale. Inputs supplied by the caller determine the output.

## API

- `GET https://tttkmbb.com/api/v1/calculate/password-entropy?length=…`
- `POST https://tttkmbb.com/api/v1/calculate/password-entropy` with JSON body `{"inputs": {…}}`
- Response: unified envelope (`success`, `request`, `result.values`, `result.units`, `sources`, `freshness`, `timestamp`, `next_actions`, `links`); see https://tttkmbb.com/docs/response-format.md
- Schema: https://tttkmbb.com/api/v1/calculators/password-entropy · OpenAPI operationId `estimate_password_entropy` in https://tttkmbb.com/openapi.json
- Authentication: none. Rate limit: fair use, see https://tttkmbb.com/docs/rate-limits.md.

## MCP

- Server: `https://tttkmbb.com/mcp` (Streamable HTTP, JSON-RPC 2.0, no auth)
- Tool:  `run_calculator` with `{"calculator_id": "password-entropy", "inputs": {…}}`

## Example

- 12 characters, all four classes: inputs `{"length":12,"lowercase":true,"uppercase":true,"digits":true,"symbols":true}` → `{"charset_size":95,"entropy_bits":78.8,"combinations":5.4036e+23,"combinations_text":"5.40 × 10^23","crack_seconds_1e9":270180000000000,"crack_time_1e9":"8.56 million years","crack_time_1e12":"8,561 years","crack_time_1e4":"856 billion years","strength":"Strong"}`
- 8 lowercase letters: inputs `{"length":8,"lowercase":true,"uppercase":false,"digits":false,"symbols":false}` → `{"charset_size":26,"entropy_bits":37.6,"combinations":208827064576,"crack_seconds_1e9":104.41,"crack_time_1e9":"1.7 minutes","crack_time_1e12":"less than a second","crack_time_1e4":"121 days","strength":"Very weak"}`

```
GET https://tttkmbb.com/api/v1/calculate/password-entropy?length=12&lowercase=true&uppercase=true&digits=true&symbols=true
```

## Limitations

You want to rate a password a person chose (dictionary words, names and patterns make it far weaker than this uniform-random model), or you need a passphrase word count (compute bits as words × log2 of the word-list size). Assumes every character is chosen uniformly at random, so entropy is the information content of the generator, not of a memorised password; human-chosen passwords typically carry 20–30 bits however long they are. The average attacker succeeds after half the key space; the strength bands are a common convention, not a standard. All values are computed from the formula above; no measurement or live data is involved.

## FAQ

**Is a longer password with fewer symbols better?**

Usually yes: each extra character multiplies the key space by the charset size, so 16 lowercase letters (75 bits) beat 10 mixed characters with symbols (66 bits).

**Why not enter my actual password?**

A calculator cannot know your password's real randomness, and typing it into a web tool is a security risk. Estimate from the policy your generator uses instead.

**How many bits are enough?**

For online logins with rate limiting 40–50 bits suffices; for offline attacks on stored hashes aim for 75+ bits, and 100+ for encryption keys or passphrases protecting long-lived secrets.

## Related

- [Exponent Calculator](https://tttkmbb.com/math/exponent.md) — Key space is charset raised to the length.
- [Combinations and Permutations Calculator](https://tttkmbb.com/math/combinations-permutations.md) — Counting arrangements in general.
- [Logarithm Calculator](https://tttkmbb.com/math/logarithm.md) — Entropy per character is log2 of the charset size.