Password Strength Calculator
Entropy in bits and how long a brute-force attack would take.
Last updated
Your details
Result
- Time to crack
- 75.4 thousand years
- Entropy
- 78.7 bits
- Possible combinations
- 4.759e+23
- Equivalent random words
- 6.1 words
Averaged over half the search space
Reasonable
From a 7,776-word diceware list
Entropy, not complexity rules
Password strength is measured in bits of entropy: length multiplied by the log base two of the character set size. Each additional character multiplies the search space, which is why length beats symbol substitution decisively.
A twenty-character lowercase passphrase carries about 94 bits — far stronger than an eight-character password using every symbol on the keyboard, which manages only about 52.
This assumes a genuinely random password
The calculation treats every character as independently random. Real passwords rarely are. "P@ssw0rd123" has the character-set profile of a strong password and the actual strength of a trivially guessable one, because attackers try dictionary transformations first.
Anything built from a word, a name, a date or a keyboard pattern falls to a targeted attack in a fraction of the time shown here. The figures are an upper bound, not a promise.
What to do instead
Use a password manager to generate long random strings you never have to remember, and enable two-factor authentication wherever it is offered — it defeats credential stuffing even when a password does leak.
For passwords you must memorise, a passphrase of five or six random words is both stronger and easier to recall than a short scrambled string.
Formula & methodology
What this calculator assumes
- Measures the strength of a password drawn at random from the stated character set. A human-chosen password of the same length and alphabet has far less real entropy, because people are not random.
- A password appearing in a breach corpus has effectively zero entropy no matter how it scores here, since attackers try those lists first.
- Crack times assume offline attack against a fast hash. A properly salted, slow hash such as Argon2 or bcrypt raises them by many orders of magnitude.
Sources
Frequently asked questions
Is my password sent anywhere?
No. This page never asks for your actual password — only its length and character set — and every calculation on this site runs entirely in your browser.
How many bits is enough?
Roughly 80 bits resists offline attack today. Aim for 100 or more on anything valuable, which a password manager gives you for free.