Password Strength Calculator
Estimate a password's entropy and crack time.
Input sheet
DIY at your own risk. Calcora's calculators and guides are general estimates and information only — not professional, engineering, legal, or safety advice. Always verify local building codes and permit requirements, and hire a licensed pro for electrical, gas, plumbing, structural, or any work you're not fully comfortable doing yourself.
A password's real strength comes from how many guesses it would take to crack, not how clever it looks. This calculator estimates entropy in bits and a rough crack time based on length and character set.
How it works
Entropy is length × log2(character-set size). Crack time assumes 10 billion guesses per second against half the keyspace.
Entropy equals the password length multiplied by the base-2 logarithm of the character-set size. A larger set (adding symbols, digits, and mixed case) and greater length both raise entropy, but length usually buys more strength per character than complexity does.
The crack-time estimate assumes a fast attacker making 10 billion guesses per second against half the keyspace on average. It also assumes truly random characters — predictable patterns, dictionary words, or reuse make a real password far weaker than the math suggests.
Entropy (bits) = length × log2(character-set size); crack time ≈ 2^(bits − 1) ÷ 10 billion guesses per second.
Worked examples
A 12-character password using the full 94-symbol set. → About 79 bits — rated Strong.
12 × log2(94) ≈ 12 × 6.55 = 78.7 bits.
An 8-character lowercase-only password (26-character set). → About 38 bits — rated Weak.
8 × log2(26) ≈ 8 × 4.7 = 37.6 bits, crackable in seconds at 10 billion guesses/sec.
Tips & gotchas
- Length beats complexity: a long passphrase of random words often outscores a short string of symbols and is far easier to remember.
- Never reuse passwords — a breach of one site exposes every account sharing that password regardless of its entropy.
- Use a password manager to generate and store high-entropy random passwords so you are not limited by what you can memorize.
- Turn on multi-factor authentication; even a strong password is a single point of failure without it.
FAQ
How many bits of entropy are 'enough'?
For important accounts aim for 70 bits or more; under 40 bits is crackable quickly by modern hardware. More is always better for anything protecting money or identity.
Why does adding symbols help less than adding length?
Each extra character multiplies the keyspace by the full set size, while widening the set only raises the per-character factor. Two more characters typically add more entropy than switching from letters to all symbols.
Does this account for dictionary or pattern attacks?
No — it assumes random characters. A real password built from words, names, or keyboard patterns is dramatically weaker than its raw bit count implies.
Related calculators
Unit Price Calculator · Dog Age Calculator · Age Calculator · Date Difference Calculator · Fuel Cost Calculator