Password Entropy Calculator
Length beats character variety. See exactly how many bits of entropy your password really has, and how long that holds up.
Assumes a fast offline attack at 100 billion guesses per second against a stretched or hashed password. Real attackers are usually slower; the point is the relative scale.
What the numbers mean
Entropy measures how many possible passwords an attacker must consider. It is length × log2(characters), so a 16-character lowercase password (about 89 bits) is far stronger than an 8-character one using every character class (about 52 bits).
The last two rows apply real-world penalties: a password built from words, years and digits is not random, so an attacker who knows the shape tries far fewer combinations than brute force implies.
Frequently asked questions
How many bits do I actually need?
60 bits defends against online guessing, 80 bits is the current NIST recommendation for new passwords, and 100 bits is comfortable if you can remember it.
Are long passwords with no symbols fine?
Yes. Length adds more entropy per character than symbol classes do, which is why NIST stopped requiring composition rules.
Why does “a password I have used before” show so little entropy?
Breach lists are checked first, and a reused password is already public. The calculator models that as a heavy penalty rather than pretending the length still protects you.
Should I use a password manager?
Yes. A manager generates a long random password, stores it, and fills it in — which is far stronger than anything a human can recall.
Is my password sent anywhere?
No. Nothing typed here is transmitted; only the length and character counts are used.