Password entropy calculator
Entropy measures how many guesses an attacker needs, assuming they know your scheme and nothing else. It is an upper bound on strength, never a lower one.
A GPU cluster against a fast hash. Against bcrypt it is nearer 1e5.
Entropy
78.84bits
- Entropy per character
- 6.570 bits
- Total combinations
- 5.4036009e+23
- Years to exhaust half the space
- 85 614.9
- Seconds to exhaust half the space
- 2 701 800 000 000
Show the working
- Password length = 12
- Character set = 95
- Guesses per second = 100 000 000 000
- Total combinations = 95^12 = 5.4036e+23
- Entropy = 12 * log2(95) = 78.8383
- average_guesses = 5.4036e+23 / 2 = 2.7018e+23
- Seconds to exhaust half the space = 2.7018e+23 / 100 000 000 000 = 2 701 800 000 000
- Years to exhaust half the space = 2 701 800 000 000 / 31557600 = 85 614.9
- Entropy per character = log2(95) = 6.569 86
Values are shown to six significant figures here; the arithmetic itself runs on exact fractions and is only rounded where a number is printed.
Scenarios & local history
Compare a saved scenario
Recent calculations
The formula
- entropy = length x log2(alphabet size)
- expected guesses = combinations / 2
This assumes a password chosen uniformly at random. A human-chosen twelve-character password has far less entropy than 78 bits, because humans are not random.
Attack rate depends entirely on the hash. The same password falls in minutes against unsalted MD5 and survives centuries against a well-tuned Argon2.