Password Entropy Calculator

What this generator does

Multiplies the length by the base-two logarithm of the character pool to get the entropy, halves the search space to get the average guesses needed, and divides by four attack rates. It also works out how many words from a standard list carry the same entropy.

How to use this tool

1. Enter the length and tick the character sets used.
2. Read the entropy in bits.
3. Compare the times across the four attacker speeds.
4. Look at the passphrase equivalent — it is usually easier to remember.

Understanding the controls

Password length

How many characters. Each extra character multiplies the search space, which is why length is worth more than complexity.

Character sets

Which sets the password draws from. Adding symbols to a twelve-character password is worth about eight bits; adding four more characters is worth about twenty-six.

Common use cases

• Comparing two password policies by the strength they actually produce
• Deciding how long a generated password needs to be
• Explaining why length beats symbol requirements
• Working out how many words a passphrase needs to match a password
• Setting a minimum entropy for a system rather than a minimum length

How this generator works

Entropy is the length times the log to base two of the pool size, which is the number of yes-or-no questions needed to pin the password down. The search space is the pool raised to the length, and an attacker finds it after half of that on average. Dividing by an attack rate gives a time. Before display the entropy is checked against the length and pool, the search space is confirmed to match the entropy by taking its logarithm back, and every time is re-derived from its own rate — with a faster attacker confirmed never to take longer.

Randomness and fairness

Nothing here is random. A length and a set of pools give exactly one entropy figure. This measures a password's theoretical strength and does not generate one.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

• These figures assume the password is uniformly random. A password you invented is worth far less, because attackers guess likely passwords first rather than searching in order.
• The attack rates are illustrative orders of magnitude; real rates depend on the hashing algorithm, its parameters and the hardware.
• Reuse defeats entropy entirely: a strong password already breached somewhere else offers no protection at all.
• Entropy says nothing about phishing, malware or a password written on a note — those are how most accounts are actually lost.

Privacy and your data

Everything is computed in your browser. Nothing you enter is a password — this takes a length and a set of character classes, never a password itself — and nothing is transmitted, stored or included in analytics.