Password Entropy Calculator

Entropy in bits is the log base 2 of the total number of guesses an attacker has to try to be sure they find your password. The formula is bits = length x log2(charsetSize), so a 12-character password drawn from the full 94-character printable ASCII pool has 12 x log2(94), about 78.6 bits. Each extra bit doubles the work for a brute-force attacker, so going from 70 to 80 bits multiplies the time to crack by 1,024x. Entropy assumes the password is chosen uniformly at random from the stated character pool; anything with a pattern (a dictionary word, a date, keyboard runs) carries far less real entropy than the math suggests.

Length wins, by a wide margin. Tripling the length of a 6-character lowercase password (about 28 bits) to 18 characters of the same lowercase pool gives 84 bits, a roughly 70-trillion-fold increase in the search space. Tripling the number of character classes instead, by adding uppercase, digits, and symbols to a 6-character password, only raises the charset from 26 to 94 and gets you to about 39 bits, a one-million-fold increase. That is why every modern guideline pushes long passphrases like 'correct horse battery staple' over short, dense strings like 'P@ssw0rd!'. Length compounds because it sits in the exponent of the entropy formula; complexity only changes the base.

Guess rates vary by attack type, hardware, password hash, work factor, salts, and rate limits. The calculator's presets are scenarios, not current hardware guarantees. For an offline breach, use measurements for the exact hash configuration. For online attacks, include the service's throttling and account-lockout behavior.

No. NIST SP 800-63B does not set an entropy-bit threshold for user-chosen passwords. Its requirements focus on minimum length, allowing long passwords, blocking commonly used or compromised values, rate limiting, and secure storage. Treat this calculator's bit estimate as a model for uniformly random choices, not proof that a human-created password meets NIST guidance.

The calculator is designed to process the field in the browser without intentionally persisting or submitting it. That does not make pasting a real password risk-free: browser extensions, compromised scripts, screenshots, crash reports, or device access can expose page contents. Test a similar example or generate a new password in a trusted password manager instead of pasting a live credential.