What Is Password Entropy?
Password entropy is a measure of how unpredictable a password is, expressed in bits. Each additional bit doubles the number of guesses an attacker must make. A password with 40 bits of entropy requires up to \(2^{40}\) (about a trillion) attempts to brute-force, while 80 bits is astronomically stronger. Entropy is the single most useful objective number for comparing password strength.
How to Use This Calculator
Enter your password length and tick every character set your password draws from. The tool adds up the pool sizes — lowercase (26), uppercase (26), digits (10) and symbols (32) — to get the character-set size N, then computes the entropy. More length and more character types both increase entropy, but length usually delivers the biggest gain.
The Formula Explained
The standard formula is $$E = L \times \log_{2}(N)$$ where \(L\) is the number of characters and \(N\) is the size of the character pool. Because each position can independently be any of \(N\) symbols, the total number of possible passwords is \(N^{L}\), and \(\log_{2}\) of that gives the bits of entropy. This assumes a truly random password; a dictionary word or predictable pattern has far less effective entropy than the formula suggests.
Worked Example
Take a 12-character password using lowercase, uppercase and digits. The character pool is \(26 + 26 + 10 = 62\). $$E = 12 \times \log_{2}(62) = 12 \times 5.954 \approx 71.45 \text{ bits}$$ That corresponds to roughly \(2^{71.45} \approx 3.2 \times 10^{21}\) combinations — extremely resistant to brute force.
FAQ
How many bits is "strong"? 60+ bits is decent for most accounts; 80+ bits is recommended for high-value or master passwords.
Does this account for dictionary attacks? No. The formula assumes random characters. Real words, names and substitutions reduce true entropy dramatically — use a random generator or passphrase.
Why use 10 billion guesses/sec? It is a reasonable estimate for a well-funded offline attack on fast-hashed passwords; slower hashing slows attackers further.
