Password Entropy Calculator

Use a uniform independent-draw model for random passwords; do not interpret the result as measured entropy or crack time for human-chosen passwords.

Password length

Alphabet size

Target bits

—Theoretical bits

—Length for target

—Combinations

—Alphabet

Formula: length × log₂(alphabet size). This is exact for independent uniform random draws from the stated alphabet, not for human-selected passwords.

Sensitive values stay in this browser page. Theoretical entropy/search-space math assumes uniform random generation and is not a crack-time promise for human-chosen passwords. Use a reputable password manager for real account storage.

Password Entropy Calculator: Bits, Crack Time & Assumptions

Estimate theoretical password entropy, detected character pool, average brute-force time at chosen guess rates and model limitations.

Guess rate / second

Model

Average guesses

Modern password guidance without false certainty

keeps password/passphrase generation and review browser-local while shifting guidance toward length, uniqueness, common-password blocking, password-manager compatibility, MFA, and compromise-driven changes rather than arbitrary composition rules or guaranteed crack-time claims.

Security boundary

A local meter can flag obvious patterns but cannot prove that a password is safe, unused elsewhere, or absent from every breach corpus. Do not paste sensitive production password exports into batch tools; generate unique secrets locally and store them in an appropriate password manager.

Practical guide and verification

Choose the entropy model that matches generation

Length × log2(character pool) is appropriate only when each character is selected independently and uniformly from the stated pool. Human-created passwords and patterned substitutions do not satisfy that assumption, so do not label the theoretical pool result as measured unpredictability.

State the guessing-rate assumption

Crack-time estimates vary by many orders of magnitude depending on the hash/KDF, hardware, rate limiting and whether the attack is online or offline. Keep the selected guesses-per-second value visible beside the time estimate instead of presenting one universal crack time.

Separate random passphrases from human phrases

A passphrase assembled by uniformly selecting words from a known list can have calculable selection entropy. A memorable sentence invented by a person has different structure and should not inherit the random-word-list estimate simply because it contains the same number of words.

Do not paste real secrets unnecessarily

A browser-local checker can reduce server exposure, but sensitive production passwords still appear in the page, browser process and screen. Prefer evaluating a generated test value or the generation policy when the actual secret does not need to be inspected.

Use authentication controls beyond password strength

Password entropy does not replace unique credentials, secure storage, MFA, rate limiting, breach detection or recovery controls. Treat the calculator as one model for candidate unpredictability, not a complete account-security score.