How this calculator works
Entropy measures how unpredictable a password is, in bits: each bit doubles the number of possible passwords an attacker with no other information would have to search through. This calculator computes entropy from password length and a character-set preset, then shows illustrative brute-force crack times at two labeled guessing speeds.
The math here assumes the password is generated uniformly at random from the chosen character set — every character equally likely, with no pattern. That assumption matters more than anything else on this page: see the honesty note below before treating any of these numbers as a safety guarantee.
The formulas
Entropy (bits) = length × log2(pool size)Total possible passwords = pool size ^ length = 2 ^ entropyAverage brute-force crack time = (total possible passwords ÷ 2) ÷ guesses per secondDividing by 2 reflects the average case: an attacker who tries combinations in a random or exhaustive order will, on average, find the password after searching half the keyspace, not all of it.
Worked example: a 12-character password, letters + digits
- Character set is lowercase + uppercase + digits, a 62-character pool.
- Entropy = 12 × log2(62) ≈ 12 × 5.954 ≈ 71.5 bits.
- Total possible passwords = 2^71.5 ≈ 3.2 × 10^21.
- At an illustrative 10 billion guesses/second (offline, fast hash), the average crack time is about (3.2 × 10^21 ÷ 2) ÷ 10^10 seconds ≈ 5,100 years.
Frequently asked questions
Does this calculator guarantee my password is safe?
No. No calculator can guarantee that. These numbers assume a truly random password and an attacker limited to brute-force guessing at the stated rate — they say nothing about whether your specific password has been leaked in a data breach, guessed via a dictionary of common passwords, or obtained by phishing, all of which bypass entropy entirely.
Why are human-chosen passwords weaker than the math suggests?
People are bad at being random. Words, names, keyboard patterns (like 'qwerty123') and predictable substitutions (like '@' for 'a') all shrink the real search space attackers need to try far below the theoretical entropy for that length and character set, because cracking tools try likely patterns first.
What are these guess rates based on?
They are illustrative reference points, not measurements of any specific system: 1,000 guesses/second represents a rate-limited online login form, and 10 billion guesses/second represents an attacker who has obtained password hashes and is cracking them offline with fast hardware. Real rates vary enormously depending on the hashing algorithm used to store the password — a slow, salted hash designed for passwords can be many orders of magnitude harder to attack than these numbers suggest.
What should I use instead of memorizing complex strings?
A password manager that generates and stores long random passwords per site, combined with a strong, memorable passphrase (several random words) for the manager itself, is the approach security professionals generally recommend over trying to memorize high-entropy strings by hand.
Why does adding symbols help so much?
Entropy grows with the character pool size for every position, not just once. Adding symbols to reach a 94-character pool instead of 62 increases the entropy contributed by every single character in the password, compounding across the whole length.