Check password strength with entropy math: see crack time in seconds, years and what makes a password truly strong.
Your results will appear here.
Enter your values and press Calculate.
Type a password and the calculator scans which character groups it uses: lowercase letters (26), uppercase letters (26), digits (10), and symbols (32). The sizes of the groups present are added to get the character pool size. Entropy in bits is then length times log base 2 of the pool size. If the password matches a known common password, its entropy is capped at 8 bits, because attackers try leaked password lists first. Finally, the average crack time is estimated as 2 raised to the power of (entropy minus 1) divided by 10 billion guesses per second, which is roughly what one modern GPU achieves against a fast password hash.
Password strength is measured with one simple formula: entropy in bits equals the password length multiplied by log base 2 of the character pool size. The pool size is not fixed. It is built by adding only the character groups the password actually uses: lowercase letters add 26, uppercase letters add 26, digits add 10, and symbols add 32. A password of 10 characters using all four groups has a pool of 94, so its entropy is 10 × log2(94), about 65.5 bits. Every extra bit doubles the number of combinations an attacker must search, which is why each added character multiplies the total search space even though the entropy number itself grows in a straight line. Follow the steps here to calculate password entropy for any password by hand.
Type or paste the password you want to analyze into the password field. The calculator detects the character groups instantly and shows the entropy in bits, a strength rating from Very Weak to Very Strong, and the estimated crack time against an offline GPU attack. Because results update live, you can experiment: add two more characters and watch the bits climb, or swap a complex 8 character password for a longer passphrase and see which scores higher. Like any trustworthy password strength checker, the page never sends what you type anywhere, so for extra safety you can test a lookalike password with the same length and pattern instead of your real one.
The same password can be unbreakable in one scenario and cracked in hours in another. The difference is the guess rate, not the password. Take a 12 character password using all character types (78.7 bits of entropy):
| Attack scenario | Guesses per second | Estimated crack time | | --- | --- | --- | | Throttled online login | 100 per hour | 2.71 × 10¹⁷ years | | Unthrottled online form | 1,000 | 7.54 × 10¹² years | | Offline slow hash (bcrypt) | 10,000 | 7.54 × 10¹¹ years | | Offline GPU cluster (fast hash) | 10 billion | 754,000 years |
This is why this crack time estimator reports the offline worst case. A database breach turns a fast hash into a race against billions of guesses per second, and strong server-side hashing like bcrypt or Argon2id is what slows that race down.
Length beats complexity tricks almost every time, because the pool size grows slowly while length multiplies the search space directly:
| Password | Length | Pool size | Entropy | Rating | | --- | --- | --- | --- | --- | | P@ssw0rd | 8 | 94 | 8.0 bits (capped, common pattern) | Very Weak | | k9#M2$vL | 8 | 94 | 52.6 bits | Fair | | Tr0ub4dor! | 10 | 94 | 65.5 bits | Strong | | correct-horse-battery-staple | 28 | 58 | 164.0 bits | Very Strong |
The 28 character passphrase wins by an enormous margin even though it uses only lowercase letters and hyphens. For accounts you must type by hand, a long random passphrase is the best trade of memorability for security. For everything else, a password manager can generate and store long random strings you never need to remember.
The strength rating comes from entropy bands used across the industry:
| Entropy | Rating | What it means | What to do | | --- | --- | --- | --- | | Under 28 bits | Very Weak | Cracked in seconds to minutes offline | Replace it now with a long random password and turn on multi-factor authentication | | 28 to 45 bits | Weak | Falls to a GPU attack in hours to days | Make it longer and stop reusing it anywhere | | 46 to 60 bits | Fair | Survives online throttling but is weak offline | Add length or switch to a passphrase to cross 60 bits | | 61 to 100 bits | Strong | Years to centuries against a 10 billion guess per second attack | Good for most accounts; keep it unique and stored in a password manager | | Over 100 bits | Very Strong | Brute force is effectively impossible | Ideal for master passwords and encryption keys |
These are estimates based on pure brute force, not professional security advice for any specific system.
The entropy formula assumes every character was picked at random, which is almost never true for passwords people choose themselves. Real attackers start with lists of breached passwords, dictionary words, keyboard walks like qwerty, number runs like 1234, and rule-based mutations such as leetspeak substitutions. A leaked or guessable password can be cracked in seconds no matter how many bits the raw math claims. This calculator treats that honestly: known common passwords are capped at 8 bits of effective entropy, and all crack times are framed as optimistic upper bounds. Uniqueness matters just as much as strength, because credential stuffing replays one leaked password across thousands of sites.
Make length your first priority: adding four random characters to a 10 character password adds about 26 bits and multiplies the search space tens of millions of times. Use a password manager so every account gets a long, random, unique password that you never have to memorize. Choose a long random passphrase for the one password you must remember, the manager's master password. Turn on multi-factor authentication everywhere it is offered, since it stops most account takeovers even if a password leaks. Never reuse passwords across sites, and re-check aging passwords every few years, because attacker hardware keeps getting faster and what was strong a decade ago may not be strong today.
Password entropy measures the unpredictability of a password in bits. It is calculated as length times log base 2 of the character pool size. Each extra bit doubles the number of guesses an attacker must try, so entropy lets you compare any two passwords on one scale.
Around 60 bits is considered strong for general online accounts, and 80 or more bits stands up well to offline GPU brute force attacks. A 12 character random password using all character types carries about 78.7 bits, while a long random passphrase easily passes 100 bits.
The crack time estimate divides the average number of guesses, 2 raised to the power of (entropy minus 1), by the attacker's guess rate. This calculator uses 10 billion guesses per second, roughly one modern GPU cracking a fast hash, as an offline worst case.
Usually yes. A 28 character passphrase like correct-horse-battery-staple has about 164 bits of entropy, far more than an 8 character complex password at about 52.6 bits, and it is much easier to remember. Randomness matters: the words must be random, not a quote or a lyric.
Reputable password strength checker pages run entirely in your browser and never transmit what you type. As a habit, test a password with the same length and pattern instead of your actual password, just in case the page is not what it claims to be.
Because attackers do not guess randomly. They try breached-password lists and dictionary rules with common substitutions (a to @, o to 0) first. This calculator caps known common passwords at 8 bits of effective entropy regardless of their character mix, which is why P@ssw0rd rates Very Weak.
Yes. A password manager generates a unique random password for every account and remembers them for you, so you never need to reuse passwords or rely on memorable patterns. Protect the manager itself with a long random passphrase and turn on multi-factor authentication.
An online attack guesses against a live login form, which rate-limits attempts, so even a 40 bit password can survive. An offline attack guesses against a stolen password database with fast hashes at billions of guesses per second, so the same password can fall in hours. That is why crack time depends on the attack scenario, not just the password.
Binary, octal, decimal and hex in one step.
Find mean, variance and standard deviation from any dataset.
See exactly how long any file takes to download at your speed.
Find how many survey responses you need for results you can trust.