Password Entropy Calculator

Computes the actual entropy of a password in bits, from length and character set — the rigorous version of "how strong is this password" that security researchers and frameworks like NIST SP 800-63B actually use, instead of the arbitrary red/yellow/green meter most sites show you.

The formula, and what it's really measuring

H = log₂(Cᴸ), where C is the character set size and L is the length. Every additional bit doubles the number of guesses an attacker needs to exhaust the space. 64 bits of entropy means roughly 18 quintillion guesses to guarantee a crack — centuries of compute time even on serious hardware. The number climbs fast, which is exactly why length matters more than most people assume.

Rough thresholds worth knowing

• <40 bits — weak, hours to crack with a GPU cluster. Not acceptable anywhere.
• 40–60 bits — fair at best, days to weeks. Only defensible for genuinely low-risk accounts.
• 60–80 bits — good, years to crack — reasonable for most everyday business use alongside other controls like MFA
• 80–100 bits — strong, decades — the floor NIST expects for high-value accounts
• 100+ bits — effectively uncrackable with any foreseeable technology

Where the entropy formula quietly lies to you

Entropy math assumes the password is genuinely random across its full character set. Real humans don't pick randomly — Password1! technically works out to around 65 bits under the raw formula, which looks fine on paper, and yet it'd be cracked in seconds by any real-world password cracker running a dictionary and a handful of substitution rules, because it's not actually 65 bits of unpredictability, it's a recognisable word with predictable padding. True entropy requires actual randomness — which is exactly why a generated password beats a human-invented one at the same nominal length, every time.