Password Entropy Calculator
Pick a length and a character set; see the bits and the size of the search space.
- Entropy
- — bits
- Character set
- — characters
- Combinations
- —
- Offline crack time
- —
Entropy is the honest way to compare password policies. Instead of arguing about whether symbols matter, you can compute exactly how much a rule adds — and most mandatory complexity rules add surprisingly little.
Set a length and a character set below. The calculator reports bits, the number of possible combinations, and the expected time to exhaust half of that space at 10^11 guesses per second.
How to use it
- Enter the length a system allows.
- Tick the character classes it permits.
- Compare two policies by changing one variable at a time.
Reading the numbers
Bits add up: each extra character multiplies the space by the set size, which is the same as adding log2(set size) bits. That is why a 12-to-16 character increase is worth far more than switching from letters-only to full symbols.
The combination count is included because it is more intuitive than bits for many people. 62^12 looks large until you notice an offline attacker covers it in days; 88^16 looks similar in shape but is 30 orders of magnitude larger.
Reviewed 2026-10-21. This tool runs entirely in your browser — no server, no account, and nothing you generate is stored.
Frequently asked questions
What is a good entropy target?
80 bits resists offline attack for the foreseeable future. 60 bits is acceptable for rate-limited online attacks only. Below 40 bits, treat the password as disposable.
Does a longer password always mean more entropy?
Only if the characters are chosen randomly. A 30-character sentence has far less entropy than the length suggests, because word order carries information.
Why does the calculator use 10^11 guesses per second?
It is a reasonable order of magnitude for a modern multi-GPU rig against a fast hash. Against bcrypt or Argon2, divide the effective rate by millions.
Related tools
More from Passwords.