Password Entropy Calculator
Estimate a password's entropy in bits from its length and character set, with a crack-time ballpark.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
Estimates a password's entropy in bits with plain pool math: length × log₂ of the character-pool size, where the pool is the sum of the classes actually present — 26 lowercase, 26 uppercase, 10 digits, 33 printable symbols, 1 space, plus a flat 100-symbol bonus class for any non-ASCII characters. It shows the detected classes, the pool size and a crack-time ballpark, and it is deliberately honest about what the model does not do: there are no dictionary checks and no pattern penalties, so a famous-quote passphrase scores exactly as high as a random string of the same shape. The crack time assumes an offline fast-hash attacker at 100 billion guesses per second — a worst case for weakly-hashed passwords, not a prophecy for bcrypt or argon2 storage. Everything runs in your browser; the password is never sent anywhere.
How it works
Entropy (bits) = length × log2(pool size) Pool = 26 lowercase + 26 uppercase + 10 digits + 33 symbols (+ others)
Entropy measures how many guesses a brute-force search needs: every added bit doubles the work. The pool is the number of characters the password could have drawn from, judged by the character classes it actually uses. This assumes each character is chosen at random, so a dictionary word scores higher here than it would against a real cracker.
| Question | Working | Answer |
|---|---|---|
| Entropy of "password" (8 lowercase letters) | 8 × log2(26) | 37.6 bits |
| Entropy of "Tr0ub4dor&3" (11 characters, 4 classes) | 11 × log2(95) | 72.3 bits |
| Entropy of "correcthorsebatterystaple" (25 lowercase letters) | 25 × log2(26) | 117.5 bits |
When to use it
Questions
How is entropy calculated?
Length × log₂ of the character pool — 26 lowercase, 26 uppercase, 10 digits, 33 symbols, 1 space. "abc123" pulls from a 36-symbol pool (lowercase plus digits), not a full-keyboard one; adding uppercase is what raises the pool to 62. Non-ASCII characters add a flat 100-symbol bonus class, a documented simplification rather than an exact count.
What is the crack-time estimate based on?
A fast-hash attacker at 100 billion guesses/second. Real-world attackers face bcrypt/argon2, which are millions of times slower — treat this as a worst case for weakly-hashed passwords.
Does "correct horse battery staple" beat this math?
Not by this model — pool math overrates dictionary phrases. Passphrases only earn their reputation when the words are truly random.
What raises entropy fastest?
Length first, then class mixing: a 16-character password from three classes beats a 10-character one from four.