Password Strength Calculator
Estimate a password’s entropy in bits and how long an exhaustive search would take, computed in your browser without sending it anywhere.
Updated Formula covered by automated tests
This password strength checker estimates how many guesses an attacker would need to try every possible password of the same length and character mix as yours. It reports the length, which character classes you used, the size of the resulting character pool, the entropy in bits, and how long an exhaustive search would take at ten billion guesses per second.
Everything runs inside this browser tab. The password you type is never transmitted, logged or saved, and you can disconnect from the network before typing if you want to be certain. Even so, the safest habit is to test a password with the same structure as your real one rather than the real one itself.
Read the number as a ceiling, not a guarantee. The entropy formula assumes every character was picked at random, which is true for passwords from a password manager and false for almost anything a person invents.
The formula
- H
- Entropy in bits: the number of yes/no questions needed to pin down the password if it was chosen uniformly at random
- L
- Length of the password in characters
- N
- Pool size: 26 for lowercase, plus 26 for uppercase, 10 for digits and 33 for the printable ASCII symbols (space included), for a maximum of 95
- R
- Assumed guessing rate, here 10,000,000,000 guesses per second, roughly what a multi-GPU rig manages against a fast unsalted hash
The formula comes from Claude Shannon’s information theory: a choice among N equally likely options carries log₂(N) bits, and L independent choices add up to L × log₂(N). Each extra bit doubles the attacker’s work, so 60 bits is about a thousand times harder than 50.
Real attackers do not try combinations in alphabetical order. They start with leaked password lists, dictionary words, names, keyboard walks such as qwerty, and rules that capitalize the first letter, swap a for @ and append a year. A password like Summer2024! has 11 characters from all four classes, so the formula credits it with about 72 bits, yet it falls in the first minutes of a rule-based attack. That gap is why the entropy shown is an upper bound.
The time figure is the full search. On average a random password is found halfway through, so halve it for the expected time. The rate also depends heavily on how the site stores passwords: a slow hash such as bcrypt or Argon2 can cut the guessing rate by a factor of a million or more.
Worked example
Priya is replacing an 8-character password, k#9Lp!2w, with a 12-character one from her password manager, q7#Vd2!mZr$K. Both use lowercase, uppercase, digits and symbols, so N = 95 for each.
- 1 Bits per character: log₂(95) = 6.570.
- 2 Old password: 8 × 6.570 = 52.6 bits, so 95⁸ = 6.63 × 10¹⁵ combinations.
- 3 At 10¹⁰ guesses per second: 6.63 × 10¹⁵ ÷ 10¹⁰ = 663,420 seconds, which is 7.7 days.
- 4 New password: 12 × 6.570 = 78.8 bits, so 95¹² = 5.40 × 10²³ combinations.
- 5 Time: 5.40 × 10²³ ÷ 10¹⁰ = 5.40 × 10¹³ seconds ÷ 31,557,600 seconds per year = 1.7 million years.
Result: Four more random characters move Priya’s password from Moderate (about 8 days to exhaust) to Strong (about 2 million years), a gain of 26 bits or roughly 81 million times more work.
Before you rely on the result
- The entropy is an upper bound that holds only for randomly generated passwords. The tool does not detect dictionary words, leaked passwords, repeated characters or keyboard patterns.
- Accented letters, emoji and other non-ASCII characters are lumped into the 33-symbol class, so their true contribution is not measured.
- The ten-billion-guesses-per-second rate is an illustrative assumption. Online attacks against a login page are far slower, while offline attacks on a weak hash with specialized hardware can be faster.
Frequently asked questions
Is a long passphrase better than a short complex password?
Often, yes, if the words are chosen at random. Four words drawn at random from a 7,776-word diceware list give 4 × log₂(7776) ≈ 51.7 bits, and six words give about 77.5 bits, while staying easy to type. This checker counts letters, not words, so it will overstate the strength of a passphrase built from a famous quote or song lyric.
Why does the checker rate Password123! as strong when it obviously is not?
Because the math only sees 12 characters drawn from all four classes, about 79 bits. It has no dictionary of leaked passwords. Any password that contains a common word, name, date or pattern should be treated as far weaker than the number shown.
Does adding one symbol help more than adding one character?
Adding a character almost always helps more. Moving a 12-character lowercase password from N = 26 to N = 59 by adding symbols lifts it from 56.4 to 70.6 bits, but making it 16 lowercase characters reaches 75.2 bits. Length multiplies the bits; a bigger pool only raises the per-character value slightly.
What do current guidelines recommend?
NIST Special Publication 800-63B advises services to require at least 8 characters (15 when the password is the only factor), allow at least 64, screen new passwords against breach lists, and stop forcing periodic changes or composition rules. For your own accounts, a password manager generating 16 or more random characters, plus multi-factor authentication, beats any memorized scheme.