ConverterHub

Password Entropy Calculator

Measure how strong a password is.

How it is calculated

Entropy in bits is bits = L × log2(N), where L is the password length in characters and N is the size of the character pool each character is drawn from. Typical pools are 26 (lowercase), 36 (lowercase plus digits), 62 (upper, lower and digits) and about 94 (all printable ASCII). Length must be above zero and the pool must be at least 2. The label depends on the total: under 40 bits is Weak, 40 to under 60 Fair, 60 to under 80 Strong and 80 or more Very strong. The formula assumes every character is chosen uniformly at random. A password built from words, names or patterns has much less real entropy than the number shown.

Worked example

A password has 12 characters, picked at random from uppercase letters, lowercase letters and digits, so N = 26 + 26 + 10 = 62. The log base 2 of 62 is about 5.9542 bits per character. Multiply by the length: 12 × 5.9542 = 71.45 bits. That falls between 60 and 80, so the label is Strong. With 8 lowercase letters only, the result would be 8 × 4.7004 = 37.60 bits, which is Weak.

Try this example →

Common mistakes

  • Entering a pool of characters you used rather than the set you could have used. Using one symbol does not make the pool 94; the pool is the whole set the generator draws from.
  • Typing a human-chosen password such as a name with a 1 at the end and trusting the figure. Predictable choices have far lower real entropy.
  • Reusing a password that scores high. The number says nothing about whether it has already leaked elsewhere.
  • Thinking each extra bit is a small change. Every added bit doubles the number of guesses needed.
  • Entering the number of words in a passphrase as length. For words, N is the word list size and L is the word count.

About this calculator

This calculator estimates password strength in bits of entropy, using length × log₂(character set size) — a password using lowercase, uppercase, digits and symbols draws from a much larger character set (and so gains entropy faster per character) than one using lowercase letters only.

It's used by anyone choosing a password who wants an objective number rather than a vague "strong/weak" label, and by developers setting minimum password policies, since a rough rule of thumb is that 60+ bits resists most practical offline brute-force attacks for the foreseeable future.

Was this helpful?

You can pick up to 3 reactions.

Comments

  • Be the first to comment.

Popular calculators

Loan Calculator

Monthly payment, total interest and full amortization schedule.

Percentage Calculator

Percent change, percent of, and ratio calculations.

Discount Calculator

Calculate final price, savings, and discount amount.

BMI Calculator

Body mass index from height and weight (metric or imperial).

Age Calculator

Compute your exact age in years, months and days from a birth date.

Compound Interest Calculator

Calculate the final amount and interest earned with compounding.

All Calculators