Password Entropy Calculator — Measure the True Strength of Any Password

Our free password entropy calculator computes the exact entropy in bits of any password based on its length and character set size. Entropy is the mathematically rigorous measure of password strength — used by security researchers, penetration testers and compliance frameworks like NIST SP 800-63B to evaluate password policies and minimum security requirements.

What is Password Entropy?

Entropy (measured in bits) quantifies the unpredictability of a password — the number of guesses required to crack it by brute force. The formula is: H = log₂(C^L) where C is the charset size and L is the password length. Each additional bit of entropy doubles the number of guesses required. A password with 64 bits of entropy requires 2⁶⁴ ≈ 18 quintillion guesses to guarantee cracking — which takes centuries even with modern hardware.

Entropy Thresholds for Security Compliance

• <40 bits — Weak. Crackable in hours with GPU clusters. Unacceptable for any production system.
• 40–60 bits — Fair. Crackable in days to weeks. Acceptable only for low-risk, non-sensitive accounts.
• 60–80 bits — Good. Years to crack. Suitable for most business applications with other security controls.
• 80–100 bits — Strong. Decades to crack with current technology. NIST minimum for high-value accounts.
• 100–128 bits — Very Strong. Computationally infeasible with foreseeable technology.
• 128+ bits — Excellent. Equivalent to AES-128 key strength. Used for cryptographic keys and highly privileged service accounts.

Entropy vs Dictionary Attacks

Entropy calculations assume purely random passwords. Real-world attackers use dictionary attacks and rule-based attacks (appending numbers, substituting letters) that can crack predictable passwords far faster than brute-force entropy would suggest. "Password1!" has 65 bits of theoretical entropy but would be cracked in seconds by any modern password cracker using common wordlists. True entropy requires true randomness — use a password generator, not human-chosen passwords.