Password Entropy Calculator
Calculate password entropy instantly and see how secure your password really is. Our Password Entropy Calculator estimates entropy in bits, crack time, character set size, and overall password strength. All calculations happen locally in your browser, so your password is never uploaded or stored.
Enter a password above and click "Test Your Password" (or pick a test preset) to run the bit entropy analysis.
100% Private Client-Side Entropy Calculation
Every calculation in this Password Entropy Calculator is performed locally inside your web browser using JavaScript. No password text is ever sent over the network, saved in a database, or logged. You can disconnect your internet or turn on airplane mode and this password entropy checker will continue working perfectly.
What Is Password Entropy?
Password entropy is a logarithmic measurement of a password's mathematical randomness and unpredictability, expressed in binary units called bits. The concept comes from information theory, created by Claude Shannon in 1948.
When you calculate password entropy, you are measuring how many total binary guesses (bits) an attacker would need to execute to exhaust the entire search space of possible passwords. Each additional bit of entropy doubles the total number of combinations:
- 1 bit of entropy: 21 = 2 possible combinations
- 10 bits of entropy: 210 = 1,024 possible combinations
- 60 bits of entropy: 260 ≈ 1.15 quintillion combinations
- 80 bits of entropy: 280 ≈ 1.2 septillion combinations
- 128 bits of entropy: 2128 ≈ 3.4 × 1038 combinations
How to Calculate Password Entropy
To check password entropy accurately, you need to identify two primary variables:
- Character Set Size (R): The total number of unique characters available in the pool used to construct the password.
- Password Length (L): The total number of character positions in the password string.
Standard character sets assign the following pool sizes:
- Numeric digits only (0–9): R = 10
- Lowercase English letters (a–z): R = 26
- Uppercase & Lowercase letters (A–Z, a–z): R = 52
- Letters and Numbers: R = 62
- Full ASCII printable set (Letters, Numbers, Symbols): R = 95
Password Entropy Formula
The standard mathematical formula to calculate password entropy online is:
Where:
- H: Entropy measured in bits.
- L: Length of the password.
- R: Size of the pool of potential characters.
- log2: Base-2 logarithm function.
For example, for a 16-character password chosen randomly from a 95-character set:
For a deep mathematical dive, read our detailed guide on Password Entropy Explained.
Password Entropy Chart
Use this visual Password Entropy Chart to interpret your score and understand the resistance level of your password against brute-force attacks:
| Entropy (bits) | Rating | Typical Resistance |
|---|---|---|
| Under 40 bits | Very Weak | Easily cracked in seconds or minutes by basic automated scripts. |
| 40–59 bits | Weak | Vulnerable to determined offline dictionary and brute-force attacks. |
| Moderate | Moderate | Suitable for many everyday low-risk online accounts with rate limiting. |
| 80–99 bits | Strong | Recommended for sensitive accounts, primary email, banking, and crypto wallets. |
| 100+ bits | Excellent | Extremely resistant to brute-force attacks. Takes millions of years to crack. |
What Is a Good Password Entropy Score?
A good password entropy score depends on the threat model and the environment where the password is used:
- 60+ bits: The minimum acceptable entropy for standard user accounts protected by online login rate-limiting.
- 80+ bits: The NIST-recommended target for financial services, root server passwords, and email accounts.
- 120+ bits: Ideal for master passwords in password managers or cold-storage cryptocurrency seeds.
To generate passwords with guaranteed high entropy, use our free Password Generator which uses the Web Crypto API to output 120+ bit passwords.
Password Entropy vs Password Strength
While closely related, password entropy and password strength are not identical:
- Entropy: Measures theoretical mathematical randomness assuming every character is truly independent and randomly selected.
- Password Strength: Incorporates real-world factors such as human behavioral bias, common dictionary words, repeated key runs, and predictable year patterns (e.g.
Summer2025!).
Our Password Entropy Calculator calculates both raw mathematical entropy and an adjusted score that penalizes predictable dictionary patterns. Learn more in our article on What Makes a Strong Password.
How Crack Time Is Estimated
Brute-force crack time estimates are calculated by dividing the total search space combinations (2H) by an assumed guessing speed.
Offline GPU Attacks
Attacker possesses the hashed password database. Dedicated GPU clusters (e.g. Hashcat arrays) test up to 100 Billion (1011) guesses per second.
Online Web Attacks
Attacker submits login attempts via web forms. Rate-limiting and IP lockouts throttle attempts down to approximately 100 guesses per second.
To protect against offline GPU cracking, systems use slow password hashing functions like Argon2, bcrypt, or PBKDF2.
Frequently Asked Questions
What is password entropy?
Password entropy is a measure of how unpredictable a password is, expressed in bits. Higher entropy generally means more possible combinations and greater resistance to brute-force attacks.
How do you calculate password entropy?
Password entropy is commonly estimated using the formula log2(R^L), where R is the size of the character set and L is the password length.
What is a good password entropy score?
An entropy score of 60 to 79 bits is considered moderate for everyday online accounts, while 80+ bits is recommended for sensitive accounts, banking, and primary email addresses. 100+ bits is virtually uncrackable under modern computing technology.
Is higher password entropy always better?
Yes. Higher entropy increases the mathematical search space, requiring an attacker to test exponentially more combinations during a brute-force attack.
Does password length increase entropy?
Yes. In fact, increasing password length expands entropy much faster than adding complex symbols because length acts as an exponent in the search space formula R^L. Read our guide on Password Length vs Complexity.
Do symbols increase password entropy?
Symbols increase the pool size R from 62 to 95 characters. While helpful, increasing the length L is significantly more effective at boosting entropy than adding symbols to a short password.
What is the password entropy formula?
The standard formula for password entropy is H = L × log2(R), where H is entropy in bits, L is password length, and R is the total number of possible characters in the pool.
Can password entropy predict crack time?
Yes, password entropy estimates the total number of combinations (2^H). By dividing combinations by guessing speeds (e.g. 100 Billion guesses/sec for GPU clusters), you can estimate brute-force crack times.
Is password entropy the same as password strength?
Not exactly. Entropy estimates randomness mathematically, while password strength may also consider common words, patterns, reused passwords, and other factors.
Does this Password Entropy Calculator store my password?
No. All calculations are performed locally in your browser. Your password is never transmitted or stored.