Password Strength Tester (Entropy Bits)
Estimate password entropy in bits and the time an offline brute-force attacker would need at common cracking rates. Pure client-side — your password is never sent anywhere.
Result
General calculation reads
Amazon affiliateAs an Amazon Associate we may earn from qualifying purchases. This does not add cost for you.
How to use this calculator
- Type or paste the password into the input.
- Choose the attacker rate — 10 G/s is the realistic modern baseline; pick higher for nation-state threat models.
- Read the entropy bits and the mean / worst-case crack-time. Flags below the result indicate why the number may be over-stated.
- Aim for ≥ 80 bits for accounts that matter; ≥ 128 for master passwords or encryption keys.
About this calculator
A password’s strength is best expressed as its entropy in bits — log₂ of the number of equally-likely passwords an attacker has to try. For a random 12-character string mixing upper, lower, digit, and symbol, that is about 78 bits — strong enough to resist a single GPU rig for centuries on a non-cached hash. This tester computes the theoretical entropy from password length and the character classes it contains, then converts to mean crack-time at four common attacker speeds: rate-limited online, slow bcrypt offline, modern GPU, and state-actor cluster. It also flags weaknesses that ruin the entropy estimate: dictionary words, short length, and use of only one character class.
How it works — the formula
entropy_bits = length · log₂(pool_size)
mean_crack_time = (2^entropy_bits / 2) / attacker_rateFor a uniformly random password from a pool of N characters, the number of equally-likely possibilities is N^length, so log₂ gives the entropy in bits. Mean-case search costs half that. Real-world passwords are far less random; entropy bits are an upper bound on resistance to brute force, not on resistance to dictionary attacks.
Worked examples
- Inputs:
- pwd=password
- Output:
- ~37.6 bits but dictionary-flagged → minutes
- Inputs:
- pwd=Tr0u4!H#9Vk2
- Output:
- ~78 bits → ~years on a GPU rig
- Inputs:
- pwd=correct horse battery staple
- Output:
- ~92 bits → centuries on a GPU rig (but only ~52 bits if attacker uses a word-list)
Limitations
- Entropy ≠ real security: dictionary + rule-based crackers find "high-entropy looking" passwords in seconds when they follow common patterns.
- No breach-list check — use haveibeenpwned.com/Passwords for that.
- Attacker-rate selection is a coarse model — real cracking speed depends on the specific hash function and hardware.
Educational estimate only — for compliance use a tool that also checks against breach databases and known dictionaries.
Frequently asked
Why is the actual security usually less than the entropy bits?+
What is NIST’s recommended length?+
Why does the attacker rate matter so much?+
Why are passphrases recommended over complex short passwords?+
Is my password sent anywhere?+
What about pwned-password breach lists?+
Related calculators
More tools you might like
Hand-picked tools that pair well with this one — same audience, same intent.
Convert numbers between hexadecimal, binary, octal, and decimal. Shows the bit pattern grouped by nibble + the two’s-complement representation for negative values.
Calculate what X% of a value is, find what percentage one number is of another, or compute the percentage change between two numbers.
Six-mode percentage tool — X% of Y, X is what % of Y, % change, % difference (symmetric), add %, and subtract %.
Generate strong, deterministically-seeded passwords. Pick length, character classes, and bulk-count. All client-side — passwords never leave the browser.
Estimate video file size from bitrate and duration, or get a recommended bitrate from resolution and frame rate using a bits-per-pixel target.
Estimate image file size by format and quality (JPEG, PNG, WebP, AVIF) from width and height, using typical bits-per-pixel figures.