Password Entropy Calculator

A bit is one coin toss. One bit means two possibilities, two bits means four, ten bits means about a thousand — every bit you add doubles the number of passwords someone would have to work through. That is why the figures here climb so steeply: 40 bits is roughly a trillion possibilities, and 80 bits is a trillion times that again.

The arithmetic is short. Count how many different characters the password could have used — 26 for lowercase letters, another 26 for capitals, 10 for digits, 32 for punctuation — and that is the pool. Each character in the password is then worth log₂ of the pool size: about 4.7 bits from lowercase alone, about 6.6 bits once all four groups are in play. Multiply by the length and you have the total.

Length is the lever. Widening the pool raises what each character is worth by a bit or two; adding characters multiplies. Four more lowercase letters beat switching to a full mix of symbols nearly every time.

• Under 28Guessed outright. Treat a password here as public.
• 28 – 49Holds up to a login form that limits attempts, and nothing more.
• 50 – 69Fine for an account you would not mind losing.
• 70 – 89Comfortable for everyday accounts.
• 90 and upOut of reach of guessing. Where a generated password lands.

One caveat, and it is a large one. This calculation assumes every character was chosen at random. It looks at which groups appear, never at what the password says — so Password123! measures a comfortable 79 bits here and is guessed in well under a second, because it is a word, a run of digits and a symbol in the order everybody uses. Entropy is a ceiling, not a promise.

If the password came from your head rather than from a generator, read this number alongside the Password Strength Checker, which weighs it against the words, dates and leaked passwords that guessing software tries first.