How to use the password entropy calculator
- Enter the password length you want to evaluate.
- Check the boxes for every character set the password draws from (lowercase, uppercase, digits, symbols, space).
- Read the entropy in bits and the total number of possible combinations.
- Review the estimated crack times at different attacker guess rates.
How password entropy is calculated
The password entropy calculator uses the formula H = L × log2(N), where L is the password length and N is the size of the character pool. The pool size is the sum of all selected character sets: 26 for lowercase, 26 for uppercase, 10 for digits, 32 for standard symbols, and 1 for space.
For example, a 12-character password using lowercase letters and digits has a pool of 36. Its entropy is 12 × log2(36) = 12 × 5.17 = 62.04 bits. Each additional bit of entropy doubles the number of guesses an attacker must try.
Character pool reference
The table below shows the pool sizes for common character set combinations used in this tool.
| Character sets included | Pool size (N) | Bits per character |
|---|---|---|
| Lowercase only | 26 | 4.70 |
| Lowercase + digits | 36 | 5.17 |
| Lowercase + uppercase | 52 | 5.70 |
| Alphanumeric (all letters + digits) | 62 | 5.95 |
| Alphanumeric + symbols | 94 | 6.55 |
| All sets including space | 95 | 6.57 |
Adding symbols increases the pool from 62 to 94, which adds about 0.6 bits of entropy per character. Over a 20-character password, that difference amounts to roughly 12 extra bits.
Estimating crack times
The estimated time to exhaustively search all combinations is T = 2H / R, where R is the guess rate per second. In practice, an attacker finds the correct password after searching half the keyspace on average, so expected time is 2H-1 / R.
This password entropy calculator provides estimates at three common rates:
- 10 guesses/sec: typical of online login forms with rate limiting.
- 10,000 guesses/sec: a throttled API or basic network authentication.
- 10 billion guesses/sec: offline hash cracking with modern GPUs using fast algorithms like MD5.
A password with 80 bits of entropy takes about 3.8 million years to search in full (1.9 million on average) even at 10 billion guesses per second. At 128 bits, the time exceeds the age of the universe by many orders of magnitude.
Entropy versus real-world strength
Theoretical entropy assumes every character is chosen uniformly at random from the entire pool. Real passwords rarely meet this assumption. People favor predictable patterns, dictionary words, keyboard walks, and common substitutions like replacing "a" with "@".
A 10-character password typed as "P@ssw0rd12" technically uses a pool of 94, giving it 65.5 bits of theoretical entropy. However, because it follows a well-known pattern, an attacker using a dictionary rule list will guess it almost instantly. For evaluating actual passwords against known patterns, use a dedicated password strength checker instead.
If you need to measure the information content of an arbitrary string rather than a theoretical password, the Shannon entropy calculator analyzes the frequency distribution of characters actually present in the text.
Choosing a target entropy
As a common rule of thumb, aim for roughly these minimums for randomly generated secrets:
- 60 to 80 bits: acceptable for short-lived tokens or low-value accounts protected by rate limiting.
- 80 to 100 bits: recommended for user-chosen master passwords and Wi-Fi keys.
- 128 bits or more: required for encryption keys, API secrets, and long-term credentials. Use a password generator or API key generator to produce these reliably.
To reach 128 bits with the full 94-character set, you need at least 20 characters (20 × 6.55 = 131.1 bits). With only lowercase letters, you would need 28 characters.
Worked examples
| Example | Input | Result |
|---|---|---|
| 8-char lowercase only | Password length: 8; Lowercase (a-z): yes; Uppercase (A-Z): no; Digits (0-9): no; Symbols (!@#$...): no; Space character: no | Character pool size: 26; Entropy: 37.6 bits; Total combinations: 208,827,064,576; Crack time (online, 10/sec): 330.9 years; Crack time (throttled, 10k/sec): 120.8 days; Crack time (offline, 10B/sec): 10.4 seconds |
| 12-char alphanumeric | Password length: 12; Lowercase (a-z): yes; Uppercase (A-Z): yes; Digits (0-9): yes; Symbols (!@#$...): no; Space character: no | Character pool size: 62; Entropy: 71.45 bits; Total combinations: 3,226,266,762,400,000,000,000; Crack time (online, 10/sec): more than a trillion years; Crack time (throttled, 10k/sec): 5.1 billion years; Crack time (offline, 10B/sec): 5.1 thousand years |
| 16-char full charset | Password length: 16; Lowercase (a-z): yes; Uppercase (A-Z): yes; Digits (0-9): yes; Symbols (!@#$...): yes; Space character: no | Character pool size: 94; Entropy: 104.87 bits; Total combinations: 37,157,429,083,400,000,000,000,000,000,000; Crack time (online, 10/sec): more than a trillion years; Crack time (throttled, 10k/sec): more than a trillion years; Crack time (offline, 10B/sec): more than a trillion years |
| 20-char passphrase style | Password length: 20; Lowercase (a-z): yes; Uppercase (A-Z): no; Digits (0-9): no; Symbols (!@#$...): no; Space character: yes | Character pool size: 27; Entropy: 95.1 bits; Total combinations: 42,391,158,275,200,000,000,000,000,000; Crack time (online, 10/sec): more than a trillion years; Crack time (throttled, 10k/sec): more than a trillion years; Crack time (offline, 10B/sec): 67.2 billion years |
FAQ
What does password entropy mean?
Password entropy measures the unpredictability of a password in bits. Each additional bit means an attacker must try twice as many combinations on average to guess it through brute force.
How many bits of entropy should a password have?
For most online accounts, 80 bits is a solid minimum. For high-value targets, encryption keys, or offline hashes, aim for 128 bits or more.
Does adding symbols really help?
Yes, but length matters more. Adding symbols expands the pool from 62 to 94, gaining about 0.6 bits per character. Adding two more lowercase characters gains about 9.4 bits, which is far more effective.
Why is my strong-looking password easy to crack?
This calculator assumes truly random selection from the chosen character sets. If your password contains dictionary words, dates, or common patterns, attackers will find it using targeted lists long before trying every combination.
Is this calculation done on a server?
No. This password entropy calculator runs entirely in your browser using JavaScript. Your inputs never leave your device.
What is the difference between this and Shannon entropy?
This tool calculates theoretical maximum entropy based on pool size and length. Shannon entropy measures the actual information content of a specific string by analyzing character frequencies.