How is password entropy calculated?

Entropy in bits equals the password length multiplied by the base-2 logarithm of the character pool size. The pool grows as you add lowercase, uppercase, digits and symbols, so longer passwords with more character types score higher.

What is a good entropy value?

As a rough guide, under 28 bits is very weak, 36 to 60 bits is reasonable, and 60 to 128 bits or more is strong. Aiming for 80 bits or more gives a comfortable margin against offline brute-force attacks.

How big is the character pool for each type?

Lowercase adds 26, uppercase adds 26, digits add 10, and common printable symbols add 33. A password using all four types draws from a pool of 95 possible characters per position.

Why does adding length help more than adding symbols?

Entropy is length × log2(pool), so length multiplies the whole figure while a larger pool only raises the per-character contribution. Two extra random characters usually add more bits than switching from one character type to another.

How is the crack time estimated?

It assumes an attacker tries half the keyspace on average — 2^bits ÷ 2 guesses — divided by a guess rate. The online estimate uses 1,000 guesses per second; the offline estimate is far faster, modelling a determined attacker with serious hardware.

Does high entropy guarantee a safe password?

No. Entropy assumes the password is random. A high-entropy-looking password built from a dictionary word plus predictable substitutions is weaker in practice, because real attackers guess patterns before brute-forcing.

Is my password sent anywhere?

No. The calculation runs entirely in your browser and your password never leaves your device.

What is the Password Entropy Calculator?

Calculate password entropy in bits from length and character variety, with an estimated brute-force crack time. Everything is analysed locally in your browser — your password is never sent anywhere. It runs free in your browser on Gera Tools, with nothing uploaded.

Password Entropy Calculator

Name: Password Entropy Calculator
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Password entropy calculator

Entropy measures how unpredictable a password is, expressed in bits — each bit doubles the number of guesses an attacker must try. This tool estimates entropy from your password’s length and the variety of characters it uses, then shows a strength label, the character-pool size, and an estimated brute-force time to crack at both online and offline attack speeds.

The difference between online and offline attacks

This calculator shows two crack-time estimates because the attack speed varies by several orders of magnitude depending on how the attacker accesses the hash:

Online attack (1,000 guesses/second) — the attacker is guessing against a live login form or API endpoint with rate limiting and lockout after a few failed attempts. This is the realistic risk for most web accounts.
Offline attack (1,000,000,000+ guesses/second) — the attacker has obtained the password hash database and is cracking it locally on GPU hardware. This is what happens after a data breach where hashed passwords are leaked. A fast hash like MD5 or unsalted SHA-1 can be attacked at billions of guesses per second; slow hashes like bcrypt or Argon2 reduce this to thousands.

The offline figure is the one that should worry you, because breaches are common and you cannot control how well a service stores your password.

How it works

The tool works out the character pool from the types present, then applies the standard entropy formula:

pool    = 26 (a–z) + 26 (A–Z) + 10 (0–9) + 33 (symbols), counting only types used
entropy = length × log2(pool)   bits
guesses = 2^entropy ÷ 2         (attacker tries half the space on average)
time    = guesses ÷ guesses-per-second

Strength bands: under 28 bits is very weak, 28–36 weak, 36–60 reasonable, 60–128 strong.

Worked examples

The password Tr0ub4dour (10 chars: lower, upper, digit) draws from a pool of 62:

Entropy: 10 × log2(62) = 10 × 5.954 = 59.5 bits (Reasonable)

Add three more characters and a symbol and the pool rises to 95, pushing entropy well past 80 bits — into Strong territory.

Example	Pool	Length	Entropy	Notes
password	26	8	37.6 bits	Very weak — common word
Passw0rd	62	8	47.6 bits	Weak — common substitution
P@ssw0rd!2x9	95	12	78.8 bits	Strong
correct horse battery staple	26	28 (with spaces)	~132 bits	Very strong passphrase

Why entropy alone is not the whole story

Entropy assumes every character is chosen randomly from the pool. A password like Summer2024! contains uppercase, lowercase, digits, and a symbol — giving it a theoretical pool of 95 and a calculated entropy of around 72 bits. But no attacker starts by trying purely random strings. They start with known patterns:

Dictionary words plus common number suffixes (Summer2024)
Keyboard walks (qwerty!, asdfgh)
Previously breached passwords from lists

A genuinely random 12-character password and Summer2024! have very different real-world resistance even if this calculator awards them similar scores. Use this tool alongside a breach-checker and a proper password manager that generates truly random credentials.

Your password is analysed entirely in your browser and is never uploaded.