Entropy calculator · crack time
Password Entropy Calculator
How long to crack my password? Enter a password or a pool size and length. See its entropy in bits, the formula worked out live, and the crack time from an online attacker to a massive GPU cluster.
Type a password, or switch to pool size and length.
Calculated in your browser. Nothing you type is sent or stored. Verify it
What Is Password Entropy?
Password entropy measures how unpredictable a password is, in bits. If a password has H bits of entropy, an attacker who knows exactly how it was generated still has to search through 2H equally likely possibilities. Each extra bit doubles the work: 41 bits is twice as hard as 40, and 80 bits is about 1.2 × 10²⁴ guesses.
Entropy is a property of the process that made the password, not of the string itself. A generator picking 16 characters uniformly from 94 printable symbols produces about 104.9 bits every time. The same length typed by a person is worth far less, because people pick words, names and patterns that attackers try first. That is why this entropy calculator is exact for randomly generated passwords and an upper bound for anything else.
The Password Entropy Formula, Step by Step
For a password of length L where each symbol is picked uniformly and independently from a pool of N possibilities:
H = L × log2(N) // bits of entropykeyspace = N^L = 2^H // possible passwordsaverage guesses = 2^(H-1) // found halfway through, on averageWorked example, a 12-character password using lowercase, uppercase and digits: N = 26 + 26 + 10 = 62.
H = L × log2(N) = 12 × log2(62) = 12 × 5.954 ≈ 71.5 bitskeyspace = N^L ≈ 3.2 × 10²¹average guesses = keyspace / 2 ≈ 1.6 × 10²¹At 10¹¹ guesses per second, the average crack time is about 511 years. The same formula covers passphrases: N becomes the number of words in the list (7,776 for the EFF large list) and L the number of words. Six words: 6 × log2(7776) ≈ 77.5 bits.
How the calculator detects the pool from a typed password: lowercase letters add 26, uppercase 26, digits 10, and ASCII symbols including space 33 (so all four together give 95). Any non-ASCII character adds a rough 100. It is the pool an attacker would have to assume for a brute-force search of that character set.
How Long Would It Take to Crack My Password?
Average crack time for a randomly generated password against an offline attacker with a GPU rig (10¹¹ guesses per second - realistic for a fast, unsalted hash like MD5 or NTLM on modern hardware):
| Length | digits (10) | lowercase (26) | letters + digits (62) | all printable (94) |
|---|---|---|---|---|
| 6 chars | less than a second | less than a second | less than a second | 3.4 seconds |
| 8 chars | less than a second | 1 second | 18 minutes | 8.5 hours |
| 10 chars | less than a second | 12 minutes | 49 days | 8.5 years |
| 12 chars | 5 seconds | 5.5 days | 511 years | 75 thousand years |
| 14 chars | 8.3 minutes | 10 years | 2 million years | 666 million years |
| 16 chars | 14 hours | 6.9 thousand years | 7.6 billion years | 5.9 trillion years |
| 20 chars | 16 years | 3.2 billion years | 112 quadrillion years | 10²⁰ years |
The speed of the attack depends on where your password is being guessed:
- Online, rate-limited (~100 guesses/s): the attacker types guesses into a login form that throttles or locks out.
- Offline, slow hash (~10,000/s): the site leaked a database hashed with bcrypt, scrypt or Argon2. Each guess is deliberately expensive.
- Offline, fast hash (~10¹¹/s): the leak used MD5, SHA-1 or NTLM. This is the case to plan for, because you never know how a site stores your password.
- Massive GPU cluster (~10¹²/s): a well-funded attacker with many GPUs. A margin-of-safety figure.
The "worst case" column in the calculator is the time to try the entire keyspace; the average is half of that.
How Much Entropy Is Enough?
| Use | Target | Get there with |
|---|---|---|
| Account with 2FA and a reputable provider | 60+ bits | 10 random characters (65.5 bits) or 5 EFF words (64.6 bits) |
| Email, banking, anything without 2FA | 80+ bits | 13 random characters (85.2 bits) or 7 EFF words (90.5 bits) |
| Password manager master password | 80+ bits | 13 random characters (85.2 bits) or 7 EFF words (90.5 bits) |
| Encryption keys, Wi-Fi, long-lived secrets | 100+ bits | 16 random characters (104.9 bits) or 8 EFF words (103.4 bits) |
More than 128 bits buys nothing practical - it is already beyond brute force by any physical computer. The site's password generator defaults to 16 characters from all 94 printable symbols, 104.6 bits.
Entropy Is an Upper Bound
The formula assumes every symbol was chosen at random. For a password a person made up, that assumption is false, and the result is only an upper limit on its strength. Password123! scores 78.8 bits here, but an attacker who tries a common word with a capital, a number run and a symbol needs only about 15 bits of work to find it.
So use this calculator for passwords and passphrases that a generator produced, where it is exact, and the password strength checker for passwords people chose, where it models the patterns attackers try first.
Password Entropy Calculator FAQs
How do you calculate password entropy?
Multiply the length by the base-2 logarithm of the pool size: H = L × log2(N). A 16-character password from 94 printable ASCII characters has 16 × 6.555 ≈ 104.9 bits. The calculator shows every step with your numbers.
What is a good entropy for a password?
60 bits is a reasonable floor for accounts protected by two-factor authentication, 80 bits for important accounts and master passwords, and 100+ bits for encryption and long-lived secrets.
How long does it take to crack a 12 character password?
If it is random and uses upper, lower and digits (62 characters), about 511 years on average at 10¹¹ guesses per second. With symbols as well (94 characters) it takes about 148 times longer. If a person chose it from words and dates, it may take seconds.
Why does my password show high entropy but the strength checker says weak?
Entropy assumes every character was picked at random. "Password123!" uses four character classes and has 78.8 bits by the formula, but it is built from a common word and a pattern: the strength checker estimates about 15 bits of real guessing work. It models how people actually choose passwords.
What guess rates does the crack time assume?
Four scenarios, from 100 guesses per second (online with rate limiting) to 10¹² per second (a massive GPU cluster). The 10¹¹ "GPU rig" row is the one we use everywhere on the site as the realistic worst case.
Does adding a symbol add a lot of entropy?
Adding symbols to the pool raises log2(N) from 5.95 (62 characters) to 6.55 (94) - about 0.6 bits per character. Adding one more character to a 62-pool password adds 5.95 bits. Length wins.
Is this calculator the same as a password crack time calculator?
Yes. Entropy and crack time are the same computation: the keyspace 2H divided by a guess rate. One page shows both so they are always consistent.
Can I calculate passphrase entropy here?
Yes. Switch to "Pool size & length", pick the EFF words preset (7,776) and set the length to the number of words. Six words give 77.5 bits.
Related tools