Password Entropy Calculator
Calculate Shannon entropy H = L × log₂(N). See strength, character pool, and crack time estimates.
Estimated Crack Times (Brute Force)
| Attack Speed | Scenario | Estimated Time |
|---|
Understanding Password Entropy
Password entropy is the measure of unpredictability in a password. It is calculated using Shannon's information entropy formula: H = L × log₂(N), where H is entropy in bits, L is the password length, and N is the size of the character pool (the number of distinct characters that could appear at each position).
A higher entropy value means a password is harder to guess. Each additional bit of entropy doubles the number of possible combinations an attacker must try in a brute-force attack. A password with 40 bits of entropy has about 1 trillion (2^40) possible combinations. One with 80 bits has about 1.2 × 10^24 — a trillion times more than 40-bit.
Character Pool Sizes
The character pool N is determined by which types of characters your password includes. Using only lowercase letters gives N = 26. Adding uppercase doubles to 52. Adding digits brings it to 62. Including symbols (!, @, #, etc.) brings the full printable ASCII set to 94. Each category you add increases N and therefore increases entropy.
Length vs. Complexity
A common debate in password security is whether length or complexity matters more. The math shows that length has a multiplicative effect on entropy (each character adds log₂(N) bits) while expanding the character pool only adds bits once. A 16-character lowercase password has H = 16 × 4.7 = 75.2 bits — stronger than an 8-character fully mixed-case password (H = 8 × 6.55 = 52.4 bits). This is why security experts increasingly recommend long passphrases over short complex passwords.
Crack Time Estimates
The crack time estimate assumes a brute-force attack testing all possible combinations. Modern password cracking hardware can test billions or even trillions of hash combinations per second for common hash algorithms like MD5. However, properly secured passwords use slow algorithms like bcrypt, Argon2, or scrypt, which reduce cracking speed to thousands or fewer attempts per second. The estimates in this tool use MD5-speed assumptions for the worst case.
Entropy vs. Real-World Strength
Entropy based on character pool and length is a theoretical maximum. Real-world password strength also depends on patterns. A password like "Password1!" has high theoretical entropy but is trivially cracked by dictionary attacks with rules. True entropy requires genuine randomness at each character position. Consider using a password manager to generate and store truly random passwords rather than choosing them yourself.