Password Entropy Calculator
Measure the mathematical strength of your passwords using bit entropy to determine how resistant they are to brute-force attacks.
Runs in your browser Your input never leaves your device.
Report a problem with this tool
About this tool
Type a password to estimate its entropy, a rough measure of how many guesses a brute-force attack would need. The tool checks which character types you used, adding to a pool size: 26 for lowercase, 26 for uppercase, 10 for digits and 33 for any other symbol. Entropy is length x log2(pool). The strength label uses an effective entropy that subtracts for repeated characters, sequential runs and common passwords, so the label can be lower than the raw figure (both are shown). Labels are Very weak below 28 bits, Weak from 28, Reasonable from 36, Strong from 60 and Excellent from 128. The password is processed locally and not sent anywhere. This is a rough estimate: the raw figure assumes random characters, and the penalties only cover simple patterns and a short list of common passwords.
How to use it
- Type or paste a password to test.
- Read the length, character pool, entropy and strength label.
- Add length or mix character types to raise the score.
Example
The naive figure is 65.7 bits, but the password is very common, so it is rated Very weak.
Password1!
Length: 10 Character pool: 95 Entropy (random-character estimate): 65.7 bits Effective entropy (after pattern penalties): 20.0 bits Strength: Very weak Warning: this is, or is built on, a very common password; attackers try these first
How password entropy is calculated
The raw figure is the password length times log2 of the character pool. Each bit doubles the number of guesses a brute-force attack needs. The pool is the sum of the character types present.
- Lowercase a-z
- 26
- Uppercase A-Z
- 26
- Digits 0-9
- 10
- Anything else
- 33 (symbols, spaces and other characters)
entropy = length x log2(pool) 12 random lowercase: 12 x log2(26) = 56.4 bits 16 random, all types: 16 x log2(95) = 105.1 bits
What the pattern penalties do
- Repeats and runs
- A character that repeats the previous one (aa), continues a sequence (abc, 123, 987) or follows a keyboard row (qwer, asdf) counts as a quarter of a normal character.
- Few distinct characters
- Passwords of 6 or more characters made of only a few different characters, such as abababab, are capped low however long they are.
- Common passwords
- If the password is on the built-in common list, or is a common word with simple substitutions (0 for o, @ for a, $ for s) or a short suffix, effective entropy is capped at 20 bits.
Passphrases and real randomness
Entropy only measures strength if the password was chosen at random. For a passphrase, count words, not characters: each word picked at random from a 7,776-word list adds about 12.9 bits, so four random words give about 52 bits and six give about 78. This tool counts characters, so its raw figure for a passphrase is usually higher than that. Use the word-based figure when you judge a passphrase.
Common problems
- A well-known password still looks strong in the raw entropy
- The raw entropy figure ignores dictionaries; the Strength label applies penalties for common passwords, repeats and runs, but only for a short built-in list. Never use common words, even with substitutions.
- A passphrase's score does not match its real strength
- Only characters and their types are counted, not words, so a passphrase of ordinary words can get a high raw figure. Its real strength depends on how many words were picked at random from how big a list. Add more random words rather than relying on the score.
- Should I test my real password?
- The text stays in your browser, but it is safer to test a similar one than your actual password.
Frequently asked questions
How many bits of entropy is a good password?
This tool rates 60 bits and above as Strong and 128 and above as Excellent, measured on the effective figure. For anything important, use a randomly generated password from a password manager or the Password Generator.
Why does the Password Strength Test give a different label?
Both tools use the same analysis, but the labels differ. The Strength Test calls 40 bits Medium and 80 bits Very strong, while this calculator uses Reasonable from 36, Strong from 60 and Excellent from 128.
Does entropy tell me how long a password takes to crack?
Not directly, because that depends on how fast the attacker can guess. The Password Crack Time Calculator turns entropy into average crack times at several attacker speeds.