Password Entropy Calculator
See how many bits of entropy a password actually has, and roughly how long it would take to brute-force under different attack speeds. Nothing you type here is sent anywhere.
Sample password
Entropy
Estimated crack time
How to use this tool
- Type or paste a sample password into the field — this runs entirely in your browser, nothing is transmitted or logged.
- The tool detects which character pools are present (lowercase, uppercase, digits, symbols) and computes entropy as length × log2(pool size).
- Crack-time estimates assume pure brute force across three realistic attack speeds, from a rate-limited login form up to offline GPU cracking.
- Use this to compare relative password strength, not as a guarantee — a long password built from a predictable pattern can be weaker in practice than its raw entropy number suggests.
Entropy measures how many guesses a brute-force attacker would need in the worst case, expressed in bits — each additional bit doubles the search space. It’s calculated from two things: how large the character pool is (does the password use lowercase only, or lowercase plus uppercase plus digits plus symbols) and how long the password is. A longer password with a smaller pool can have more entropy than a shorter one with a larger pool, since length matters exponentially and pool size only matters logarithmically.
The three crack-time scenarios shown reflect real differences in how an attacker gets to guess. An online, rate-limited login form might only allow a handful of attempts per second before locking out or throttling. An offline attack against a leaked, slowly-hashed password database (bcrypt, scrypt, Argon2 done properly) might manage thousands of guesses per second. An offline attack against a fast, unsalted or poorly-hashed database on modern GPU hardware can hit billions of guesses per second — which is why how a service stores your password matters as much as how strong the password itself is.
Entropy is a brute-force metric, and real attacks are rarely pure brute force. Dictionary attacks, common substitution patterns (o to 0, a to @), and known-breach password lists let attackers skip most of the search space for passwords that follow predictable human patterns, even long ones. A long passphrase of unrelated words scores well on both entropy and real-world resistance; a password that’s technically high-entropy but follows an obvious keyboard pattern can be cracked far faster than its bit count implies.
Frequently asked questions
What’s a “good” entropy score?
As a rough guide, under 40 bits is weak, 40-60 bits is reasonable for a lower-stakes account, and 60+ bits is strong for most purposes. But entropy alone doesn’t capture predictability — a random 12-character password and a 12-character keyboard-walk pattern can compute to similar entropy while having very different real-world crack resistance.
Why do the crack-time scenarios vary so much?
Because attack speed depends entirely on how the password is being attacked. A login form that rate-limits attempts might allow only 10 guesses a second; an offline attack against a poorly-hashed, leaked database can run billions of guesses a second on modern hardware. The gap between those two is the difference between a password lasting centuries or seconds.
Is it safe to type my real password into this tool?
The calculation runs entirely in your browser via JavaScript and nothing is transmitted, logged, or stored — you can verify this by checking your browser’s network tab and seeing no requests fire as you type. That said, using a similar but not identical sample is a reasonable habit for any tool, including this one.
Does password length or character variety matter more?
Length matters more, because it affects entropy exponentially while pool size only affects it logarithmically. Going from a 10-character to a 16-character password using the same character types increases entropy far more than adding symbols to a 10-character password does.