Password / Entropy Calculator
Estimate a password’s entropy in bits and how long it would take to crack, computed entirely in your browser.
Runs locally in your browser
Runs locally — nothing is sent anywhere.
Generate locally in your browser
Estimates assume random characters and a fast offline attack. Real passwords with words or patterns may be weaker.
Discuss a result
Write a short summary and review it before posting. Your tool inputs are never copied automatically.
What is the Password / Entropy Calculator?
This tool estimates the entropy of a password in bits based on its length and the character sets it uses, and translates that into an approximate offline crack time. Your password is never sent anywhere.
How to use it
- 1Type a password (it stays local).
- 2Read the entropy, strength rating and estimated crack time.
How it works
Entropy ≈ length × log2(pool size), where the pool grows with each character class used (lowercase, uppercase, digits, symbols). Crack time assumes a fast offline guessing rate.
Limitations & notes
- Entropy assumes random characters; real passwords with words or patterns are weaker.
- Dictionary and reuse attacks are not modeled.
Frequently asked questions
How long should a password be in 2026?
For a randomly generated password stored in a password manager, use at least 16 characters; this tool defaults to 20. NIST guidance (SP 800-63B) sets an 8 character minimum for user-chosen passwords, requires 15 when a password is the only factor, and favors length over forced complexity rules. A 12 character random password with all four character types already measures about 79 bits here, but extra length costs nothing when you never type it.
Is a password generated here truly random?
Yes. It uses the browser's crypto.getRandomValues, the same cryptographic source used for encryption keys, not Math.random. Random bytes that would make some characters more likely are discarded and redrawn, so every allowed character is equally probable. The tool also guarantees at least one character from each group you tick, then shuffles the result. The password is created on your device and never sent anywhere.
Why does Summer2026! show as strong when it is easy to guess?
The meter calculates entropy as if every character were chosen at random: 11 characters from a pool of 95 gives about 72 bits and a crack time of centuries. Real attackers try dictionary words, seasons, years and a trailing ! first, so a password like that falls in seconds. The rating is only meaningful for random passwords, such as those from the generator, not for passwords you made up.
Are passphrases better than random passwords?
They can be just as strong and are easier to type. Strength depends on how many words are picked randomly from how large a list. With the 7,776 word Diceware list, each word adds about 12.9 bits, so six random words give about 77 bits. Note that this meter scores correcthorsebatterystaple as 117 bits because it counts letters, not words; its real strength as four common words is closer to 44 to 52 bits.
What does the estimated crack time assume?
An attacker who has stolen a password hash and can test 100 billion guesses per second offline, finding the password after searching half of all combinations on average. That suits fast hashes on a GPU cluster. Sites using slow hashes such as bcrypt or Argon2 make attacks thousands of times slower, while online login forms are limited much more. The character pool counts 33 symbols, slightly more than the 18 symbols the generator uses, so the bits shown for generated passwords are a small overestimate.
No directly related discussion yet.
Start a focused thread and share the question this tool helped you explore.
Ask the community about Password / Entropy Calculator