Password entropy calculator

Provide the password length, identify the character pools from which every position may be selected, and state an attacker’s guesses-per-second rate. The result reports the combined pool size, entropy in bits, average guesses, and a rough order of magnitude for average cracking time. It is intended for uniformly random passwords and generated secrets, not for judging memorable passwords, reused credentials, dictionary words, or predictable human patterns.

Understand what the entropy figure means

The calculator uses the standard model in which every character position is selected independently and uniformly from one combined pool. If a generator chooses from 26 lowercase letters and makes a twelve-character password, there are 26 raised to the twelfth power possible strings. Entropy is the base-two logarithm of that search space, so it expresses the same quantity as a number of binary decisions. Adding character types increases the pool, while adding length multiplies the number of possibilities again. The result is theoretical because it describes the generation process, not merely the appearance of a finished password. A human-created string containing a capital, a digit, and a symbol may look as if it uses a large pool while actually following an extremely predictable pattern. Use this estimate when the stated pools genuinely describe random selection at every position. For human choices, dictionary-aware strength analysis is a better model than simple combinatorics, and a leaked or reused password should be replaced regardless of its calculated bits.

Read the time-to-crack estimate carefully

Time to crack is derived from the same search-space model and the guesses-per-second rate you provide. An exhaustive attacker finds a uniformly random target after half of the possible guesses on average, so the calculator divides the full space by two and then by the attack rate. It returns scientific notation to keep very large and very small results unambiguous, plus a deliberately rough phrase such as tens of years or hundreds of million years. That phrase is an order of magnitude, not a deadline or guarantee. Guess rates vary radically with the storage system, hash algorithm, hardware, attacker budget, and whether attempts happen online or against a stolen password database. Online services normally impose throttling and lockouts, while a fast unsalted hash may permit massive offline rates. Compare scenarios by changing the stated rate, and document that rate whenever you share the result. The estimate becomes meaningful only when readers know which attack assumption produced it.

Choose character pools without double counting

Select lowercase, uppercase, digits, or symbols when those standard pools match the generator. Their sizes are 26, 26, 10, and 32 respectively, and duplicate names are counted only once. If a generator uses a different alphabet, select custom by itself and provide the exact number of distinct characters available at every position. Keeping custom separate prevents accidental overlap, such as counting lowercase letters once in a named pool and again inside a custom alphabet. The calculation assumes that all declared characters can occur in every position with equal probability. Rules such as requiring exactly one digit, forbidding symbols in the first position, or weighting some characters more heavily create a different search space and are not represented by the simple formula. Likewise, this tool does not receive or inspect the password itself, which is useful when documenting a generator policy without exposing a secret. The API costs $0.002 per successful request. Record the length, pool definition, and guess rate alongside the output so another reviewer can reproduce the estimate precisely.