Password Strength Calculator
Entropy bits and crack time from length and character set.
What it does
Password strength is counting: pool size raised to length gives the guesses, and log base two converts that count to entropy bits. Sixteen random characters from all ninety four symbols hold about 105 bits, which brute force cannot touch.
The tool above takes length and character set. It returns entropy bits, crack time at ten billion guesses a second, and a plain rating.
Human passwords fall far below random math because attackers try dictionaries, names, and leaks first. Entropy here assumes truly random generation, which password managers provide and brains do not.
Reuse kills strong passwords faster than length saves them. One breached site hands attackers the exact string for every other account sharing it, no cracking needed.
How to use
- Enter the password length.
- Pick the character set actually used.
- Read entropy and crack time together.
- Generate unique passwords in a manager instead of memorizing.
Formula
- pool
- Symbols available: 26, 62, 94, or 10 for PINs.
- log2
- Bits per character from the pool size.
- 10B/s
- Fast rig guess rate assumed here.
Real attacks start with leaked lists, so random strings are the premise. Dictionary words carry far less entropy than their length suggests.
Worked example
Example: 16 characters, full set of 94
Length 16, all symbols.
- Bits per character: log2(94) = 6.55.
- Entropy: 16 x 6.55 = about 104.9 bits.
- Guesses: 2^104.9 / 2 at ten billion a second.
- Time: tens of trillions of years. Rating Excellent.
Reference table
| Password | Bits | Verdict |
|---|---|---|
| 4 digit PIN | 13.3 | Instant |
| 8 lowercase | 37.6 | Weak, minutes |
| 12 mixed full | 78.7 | Good, millennia |
| 16 mixed full | 104.9 | Excellent, eons |
| 5 word passphrase | ~65 | Good if random words |
Limits
- Random strings assumed. Human patterns fall faster.
- Rate guesses vary by hash. Weak hashes fall quicker.
- Phishing bypasses strength entirely.
- Leaked passwords rate zero regardless of math.
Common mistakes
- Reusing one strong password everywhere.
- Trusting complexity rules over length.
- Rotating passwords on schedules without cause.
- Storing passwords in plain notes or mail.
- Skipping two factor on email and money accounts.
Try it yourself
Quick checks. Answers sit tucked under each question.
8 characters, full 94 set. Bits?
8 x 6.55 = 52.4 bits. Fair rating.
Why do managers win?
They hold unique random strings per site, removing reuse and memory limits.
Questions
How long should passwords be?
Sixteen plus random characters, or five plus random words. Length first.
Are symbols required?
Helpful but secondary. Extra length beats extra symbols.
What is entropy?
Log base two of the guess count. Eighty bits means 2^80 possibilities.
Is a 4 digit PIN safe?
Only with lockouts and short windows. Thirteen bits fall instantly offline.
Should I change passwords often?
No, on suspicion or breach only. Forced rotation breeds weaker picks.
What beats a strong password?
Phishing and reuse. Two factor authentication covers both gaps.