Password Strength Calculator
How many combinations a password's length and characters allow, its entropy in bits, and how long trying every one would take at a guessing speed you choose.
Result…
How it's calculated
Combinations = pool size ^ length Entropy (bits) = length × log₂(pool size) Time to try all = combinations ÷ guesses per second · Average = half of that
Each position can be any character in the pool, so a password of length L from a pool of P characters has P^L possibilities, and its entropy is L × log₂(P) bits: every extra bit doubles the search. The sets are 26 lower-case letters, 26 capitals, 10 digits and 32 keyboard symbols (94 together). The guessing speeds are illustrative examples, not measurements: a website that limits login attempts allows very few guesses, while an attacker who has stolen a database of fast, unsalted hashes can try billions a second on graphics cards, and slow hashes designed for passwords cut that by many orders of magnitude. The figures only hold for a password chosen at random from the pool. Human-chosen passwords are far weaker than their length suggests, so use a password manager to generate long random ones, and turn on two-factor sign-in where it is offered.
Your numbers, step by step
About the Password Strength calculator
This password strength calculator shows the brute-force size of a password: how many combinations its length and character sets allow, its entropy in bits, and how long trying every one would take at a guessing speed you pick. Choose the sets you use (lower-case letters, capitals, digits and the 32 keyboard symbols) or type your own pool size, such as 10 for a PIN. The guessing speeds are labelled examples, from a throttled online login to an offline attack on fast hashes, and you can enter your own. The steps show the power, the logarithm and the division with your numbers. Keep in mind what the figure means: it is a ceiling for a password chosen at random. Passwords built from words, names, dates or patterns fall far faster, so no result here says a password is safe.
How to use it
- Under “Characters from”, choose “Character sets” or “Pool size”.
- Enter the “Password length” in characters.
- Switch each set on or off, or enter the “Characters in the pool”.
- Pick a “Guessing speed” example, or “My own guesses per second” and type a rate.
- Read the time to try every combination, the average time (half of it) and the entropy in bits.
Worked example
A random 12-character password of letters and digits draws on 26 + 26 + 10 = 62 characters, so there are 62^12 ≈ 3.226 × 10²¹ combinations and 12 × log₂(62) ≈ 71.5 bits of entropy. At the example speed of 10 billion guesses a second, trying them all takes about 10,200 years, and half of that, about 5,110 years, on average. A random 16-character password using all 94 characters has about 104.9 bits and would take about 1.18 × 10¹⁴ years at the same speed.
Updated
Questions people ask
How do I calculate how long a password takes to crack?
Raise the pool size to the power of the length to get the combinations, then divide by the guesses per second. That is the time to try every one; on average a search finds the answer halfway through.
What is password entropy in bits?
Entropy is length × log₂(pool size). Each extra bit doubles the number of guesses needed, so 72 bits takes twice as long as 71. The logarithm calculator works out log₂ of any number.
Does adding symbols help more than adding length?
Length usually helps more. Going from 62 to 94 characters raises each character from about 5.95 to 6.55 bits, a gain of about 0.6 bits, while one more character from 94 adds about 6.55 bits. A long random password is the strongest choice the calculator can show.
Why is my real password weaker than this result?
The result assumes every character was picked at random. Attackers try dictionary words, common substitutions, names, dates, keyboard runs and leaked passwords first, so a human-chosen password can fall in a tiny fraction of the brute-force time.
Which guessing speed should I use?
It depends on the attack. A website that limits login attempts allows very few guesses, while a stolen database of fast hashes can be attacked offline at billions of guesses a second. The presets are examples, not measurements, so try several.
Does a long time mean my password is safe?
No. It only describes brute force against a random password. Reuse, phishing and data leaks bypass it entirely, so use a password manager for long random passwords and turn on two-factor sign-in where it is offered.