Calculate Password Entropy — Measure Randomness in Bits
Enter your password and this free password entropy calculator instantly breaks it down using Shannon's formula — L × log₂(N) — giving you total entropy in bits, an entropy rating from Weak to Very Strong, charset size, bits per character, and a visual security scale. The character analysis panel shows exactly which types you're using — lowercase, uppercase, numbers, and symbols — so you can see precisely what's driving your password entropy.
What Is Password Entropy? A Practical Password Strength Test
Entropy measures unpredictability—the mathematical foundation of password security. The pin generator shows how many possible combinations exist for your chosen length so you can assess the risk.
Password entropy is the measure of password strength borrowed from information entropy — specifically, it quantifies the unpredictability of your password from an attacker's perspective. The concept originates with Claude Shannon's work on information security, which established that password entropy is equal to the Shannon entropy of a uniform distribution over all possible character combinations. In plain terms: the higher the entropy, the harder your password is to guess, brute-force, or crack through any automated means. Much like entropy in thermodynamics measures disorder in physical systems, this is the foundation of password strength measurement in modern cybersecurity and cryptography.
When an attacker launches a brute force attack, they run an automated computer program to try every possible letter, number, and special character combination until the correct one is found. If your password has n bits of entropy, an attacker needs at most 2n guesses — and, on average, 2n − 1 guesses to achieve a 50% chance of finding the password. That exponential relationship is why adding even a few characters, or expanding the character pool, creates an astronomically larger search space — from a modest online attack rate of a thousand attempts per second, all the way up to a high-speed offline attack running via a massive cracking array at 100 trillion attempts per second.
How Many Bits of Entropy Does a Strong Password Need?
Entropy thresholds vary by account security sensitivity. For non-vital accounts — a newsletter subscription or a low-stakes forum — 25–30 bits provides a reasonable baseline. For important accounts such as email, social media, and online subscriptions, aim for 60–80 bits. For your bank account password, corporate authentication systems, or any account holding sensitive personal data, target 100 bits for crucial accounts. A password is generally considered secure if it achieves at least 50 bits of entropy and does not appear in any leaked password list.
| Entropy (bits) | Strength Level | Estimated Time to Crack |
|---|---|---|
| < 28 | Very Weak | Seconds to minutes |
| 28 – 35 | Weak | Hours to days |
| 36 – 59 | Moderate | Weeks to months |
| 60 – 79 | Strong | Centuries |
| 80 – 99 | Very Strong | Millions of years |
| 100+ | Extremely Strong | Billions of years to crack |
The Difference Between Entropy and Password Complexity
Entropy and complexity are related but distinct concepts in password auditing. Complexity, as enforced by a typical password policy (e.g., password must contain upper case letters and numbers), addresses surface-level password composition — it verifies the presence of certain character types against a set of known criteria but says nothing about predictability. A password like P@ssw0rd! satisfies every complexity requirement yet carries very low entropy because it follows an entirely recognizable pattern that attackers test first in a dictionary attack. True entropy requires password randomness — characters selected without any pattern, making the password genuinely unpredictable. Complexity requirements are a useful policy floor, but entropy is the ceiling that actually determines digital security.
The Password Entropy Formula — Explained for Every Password Strength Tester
See how different password configurations affect entropy. The password policy validator highlights exactly which rules a password fails so you know what to adjust.
The entropy formula is elegantly simple. Password entropy is equal to the Shannon entropy for strings of length L drawn uniformly from a pool of R characters:
E = log₂(RL)
Using the properties of logarithms, this is equivalent to:
E = L × log₂(R)
If your environment doesn't support log base 2 natively, apply the log change-of-base formula:
E = L × ( log(R) / log(2) )
Here, L is the number of characters in your password and R is the size of the pool of unique characters from which the password is constructed. The formula tells us that increasing either L or R will strengthen the password: you can either expand the pool by including more character types, or simply make the password longer. Crucially, a longer password from a smaller pool can achieve the same entropy as a shorter yet more complex password — length, randomness, and complexity all contribute, but length is often the most efficient lever to pull.
Breaking Down the Character Pool (R) — Pool Size Reference
The pool of characters — also called the charset — is determined by which types of characters appear in your password. You don't need to count individual characters; you need to identify which categories are represented, then sum the pool size for each category.
| Pool | Elements | Pool Size (R) |
|---|---|---|
| Digits only | Digits 0–9 | 10 |
| Lowercase letters only | a–z | 26 |
| Uppercase letters only | A–Z | 26 |
| Upper + lowercase letters | a–z, A–Z | 52 |
| Alphanumeric (lower + digits) | a–z, 0–9 | 36 |
| Alphanumeric + uppercase | a–z, A–Z, 0–9 | 62 |
| Special symbols (US keyboard) | ~!@#$%^&*()-_=+[{]}\|;:'",<>.?/` | 32 |
| Full character set (all types) | 26 + 26 + 10 + 32 | 94 |
Some calculators, including tools inspired by GRC's algorithm, apply a 33-symbol charset rather than 32 to account for the space character.
Worked Examples — Step-by-Step Password Strength Calculations
Lowercase-only password (the short-password trap)
L = 9, R = 26 → E = 9 × log₂(26) ≈ 9 × 4.700 ≈ 42.5 bits
At 42.5 bits this falls in the moderate range — but its real crack time drops sharply if it matches a dictionary word like "incorrect," cracked in seconds by a word-list attack.
Mixed-case alphanumeric password (the common corporate requirement)
L = 11, R = 62 → E = 11 × log₂(62) ≈ 11 × 5.954 ≈ 65.5 bits
This sits firmly in the strong range. A 16-character password using the same pool would push entropy well above 95 bits.
Full character set — the strongest possible password for a given length
L = 11, R = 94 → E = 11 × log₂(94) ≈ 11 × 6.555 ≈ 72.1 bits
To hit 100 bits with a full R = 94 pool you'd need roughly 16 characters. At 100 billion attempts/second, a random 16-character full-charset password would still take millions of years to crack — an 8-character one falls in minutes.
How This Password Strength Testing Tool Evaluates Your Password
Two complementary approaches combine to give you the most accurate picture of how strong your password really is.
Is It Safe to Enter Your Password Here? Privacy and Password Security
Your password is processed locally in your device's web browser — it is never transmitted to our servers. The calculation happens entirely on your device, meaning your credential stays completely private. This makes it a 100% safe calculator and a secure password checker by design. When evaluating any password strength checker, always verify that it does not transmit your password to an external server before using it.
How the Password Strength Score Is Calculated (zxcvbn and Beyond)
For pattern-based analysis, this calculator uses the zxcvbn library — the same engine Bitwarden and other leading credential tools rely on for password strength calculations. zxcvbn goes beyond raw bit strength by checking your password against password dictionaries, common keyboard patterns, date formats, and name lists. It catches substitutions like p@ssw0rd that appear complex but are trivially predictable, because attackers maintain dictionaries of leaked passwords that include such patterns. The library returns a strength score from 0 to 4 along with a human-readable label and a projected time to compromise.
For the brute-force search space view, this tool lets you evaluate your password against multiple attack scenarios: a throttled web-based attempt rate of a thousand tries per second, an offline fast attack at 100 billion attempts per second, and a massive cracking array running 100 trillion attempts per second. The web-based scenario is most relevant for applications without rate-limiting, while the high-speed scenario is relevant after a data breach exposes password hashes to a direct attack.
Entropy Alone Won't Save You — Password Best Practices
Understand the information theory behind password strength measurements — and its limits.
Even a mathematically strong password can be compromised through phishing, credential stuffing, password reuse, or inclusion in a list of leaked passwords. A high score from a password entropy calculator measures resistance to guessing — it cannot protect you from human-layer attacks or from reusing the same password across sites. Understanding these limits is the difference between false confidence and genuine online privacy.
Passphrases — High Entropy, High Password Security, Easy to Remember
A passphrase — a sequence of four or more unrelated words — offers an elegant solution to the tension between password security and memorability. Because the pool effectively becomes the entire vocabulary and the "length" is counted in words rather than characters, a multi-word credential like correct-horse-battery-staple achieves very high cryptographic strength while remaining easy to recall. Such long phrases are an excellent strategy for accounts where you must type the password manually, such as your password vault master credential. For everything else, let a password generator handle secure password generation and store the result in a credential manager.
Worst Password Habits — Common Poor Password Practices to Drop Today
Awareness of common password mistakes is as important as understanding entropy. Here is a practical do/don't framework:
✗ Don't
- Use the same password repeatedly across multiple sites — one breach exposes every account sharing the credential.
- Rely on predictable substitutions like
P@ssw0rd— attackers already know@→aand0→o. - Use personal information — birthdays, pet names, or addresses create recognizable patterns.
- Use common passwords like "password", "qwerty", or "123456" — tested in the first seconds of any cracking attempt.
✓ Do
- Make it long — aim for 14+ characters. An 8-character password can fall in hours; a random 16+ character one takes a billion years at GPU speeds.
- Make it random — use uppercase, lowercase, digits, and symbols together, or a trusted password generator, free of any pattern.
- Make it unique — a distinct password per account, ideally via a password manager, so one breach can't cascade.
- Use multi-factor authentication — a second factor blocks account takeover even if a password is compromised.
Understanding what makes a strong password ultimately comes down to three pillars: make it long, make it random, make it unique. These secure password creation steps — combined with a password manager and good password hygiene habits — give your credentials cryptographic strength that goes far beyond raw entropy.
For password safety at scale, organizations should also implement formal password requirements that encode these rules, conduct periodic password auditing against common password list databases, and use rainbow-table-resistant password hashing — such as bcrypt or Argon2 — on the server side. Hash cracking resistance depends on both the hashing algorithm and the underlying password strength; even a strong hash cannot fully compensate for a weak credential.
Frequently Asked Questions
- What is password entropy?
- Password entropy is a measure of how unpredictable a password is, expressed in bits. The higher the entropy, the harder a password is to guess or crack by brute force. It's calculated using the size of the character pool and the length of the password: entropy = log2(pool_size ^ length).
- How is password entropy calculated?
- The formula is: Entropy (bits) = Password Length × log2(Pool Size). The pool size is the total number of unique characters available — for example, lowercase only gives 26, while adding uppercase, digits, and symbols can push the pool to 94. A longer password with a larger pool yields much higher entropy.
- How many bits of entropy is considered a strong password?
- Generally, 60–80 bits of entropy is considered good for most purposes, and 80+ bits is strong. Security professionals often recommend aiming for at least 72 bits. Anything below 40 bits is considered weak and susceptible to brute-force attacks.
- Why does password strength matter?
- Weak passwords are the most common entry point for attackers. A password with low entropy can be cracked in seconds using modern hardware and dictionary or brute-force attacks. Higher entropy means exponentially more guesses are required, making attacks impractical.
- Does adding special characters really help?
- Yes — special characters increase the character pool size from 62 (lowercase + uppercase + digits) to 94, which significantly raises entropy per character. However, increasing password length has an even larger impact on overall entropy than adding character types alone.
- Is it safe to use a password entropy calculator?
- This calculator processes everything locally in your browser — no data is transmitted to any server. You can safely type or construct a hypothetical password to test its entropy without any privacy risk.
- How do I create a strong password?
- Use at least 12–16 characters and include all four character types: lowercase, uppercase, digits, and special characters. Avoid dictionary words, names, and predictable patterns like "123" or "abc". Better yet, use a passphrase — a random string of 4–5 unrelated words — which can have high entropy and be easier to remember.
- What is the difference between password entropy and password strength?
- Entropy is a purely mathematical measure based on character pool size and length, assuming the password was chosen randomly. Strength tools like zxcvbn also check for patterns, dictionary words, and common substitutions, which means a high-entropy estimate doesn't guarantee a strong password if predictable patterns are used.