Password Entropy & Strength Calculator
Estimate how strong a password is by computing its entropy in bits and the time needed to brute-force it.
chars
Lowercase letters (a-z)
Uppercase letters (A-Z)
Digits (0-9)
Symbols (!@#...)
/s
Strength: Strong
- 1
Character pool
26 + 26 + 10 + 32 = 94Sum of selected character set sizes (a–z=26, A–Z=26, 0–9=10, symbols=32). - 2
log₂(pool)
log₂(94) = 6.5546 - 3
Entropy (bits)
12 × 6.5546 = 78.7
How does this calculator work?
Password entropy is length × log2(pool size), where the pool sums the included character sets (max 94). More bits means exponentially more guesses to brute-force. Aim for 60+ bits for normal accounts and 128+ for critical secrets, assuming the password is truly random rather than a guessable word or pattern.
Formula
How this is calculated
The character pool is the count of distinct symbols available to the attacker, summed from the sets you include: lowercase (26), uppercase (26), digits (10) and common symbols (32), for a maximum of 94. A password drawn from a larger pool and made longer is exponentially harder to guess.
Entropy in bits is length × log2(pool). Each bit doubles the number of possibilities, so adding characters or expanding the pool raises strength quickly. The strength label follows common thresholds: under 28 bits is weak, 28-60 is fair, 60-128 is strong, and 128 bits or more is very strong.
Crack time assumes an offline brute-force attack that tries every combination. The total combinations equal pool^length; on average an attacker finds the password after trying half of them, so attempts = pool^length ÷ 2, and crack time = attempts ÷ guesses-per-second. The default rate of 1e10 guesses/s reflects fast offline GPU cracking of weak hashes; real-world online attacks are far slower. This is a theoretical upper bound and assumes the password is truly random, not a dictionary word or predictable pattern.
Frequently asked questions
Entropy measures unpredictability in bits. Each extra bit doubles the number of guesses needed, so more bits means a stronger password.
Aim for at least 60 bits for everyday accounts and 128 bits or more for high-value secrets. A 16-character password using all four sets exceeds 100 bits.
No. It assumes a fully random password. Real passwords using words, names or patterns have far less effective entropy and crack much faster.
Also known as
TG we-Calculate Editorial Team. (2026). Password Entropy & Strength Calculator [Online calculator]. TG we-Calculate. https://we-calculate.com/calculator/password-entropy-calculator
TG we-Calculate Editorial Team. "Password Entropy & Strength Calculator." TG we-Calculate. 2026. https://we-calculate.com/calculator/password-entropy-calculator.
TG we-Calculate Editorial Team, "Password Entropy & Strength Calculator," TG we-Calculate, 2026. [Online]. Available: https://we-calculate.com/calculator/password-entropy-calculator
@misc{wecalculate_password_entropy_calculator, title = {Password Entropy & Strength Calculator}, author = {{TG we-Calculate Editorial Team}}, howpublished = {\url{https://we-calculate.com/calculator/password-entropy-calculator}}, year = {2026}, note = {TG we-Calculate} }
Did this calculator help you?