Password Entropy (bits)
Estimate the brute-force strength of a password from its length and character pool, plus a crack-time sanity check.
Your recent runs (stored only in your browser)
No calculations yet — results land here so you can compare runs.
The engineering
This is the classic Shannon estimate of password strength: entropy H equals length L times the base-2 log of the character-pool size N. It measures the guessing difficulty of a password drawn uniformly at random from that pool — so it is an upper bound. A human-chosen 'password' with obvious patterns has far less real entropy than the formula reports.
Rules of thumb: each printable-ASCII character adds ~6.55 bits, each alphanumeric adds ~5.95, each lowercase letter only ~4.7. NIST SP 800-63B (2017) dropped the old composition and forced-rotation rules precisely because they inflate this theoretical number while pushing users toward predictable substitutions — length and screening against breached lists beat mandated symbols.
The crack-time row uses half the keyspace (the average guess lands halfway through) at a chosen offline guess rate; 10¹⁰ guesses/s is a reasonable single-GPU figure for a weak hash. If your login is online and rate-limited, the effective rate is millions of times lower.
Where this math comes from
The information-theoretic backbone is Claude Shannon's 1948 A Mathematical Theory of Communication, which defined entropy in bits and, in a 1951 follow-up on printed English, showed how far real symbol streams fall short of their maximum entropy — the exact reason human passwords underperform this formula.
Password entropy as a security metric was codified by NIST: William Burr's 2004 SP 800-63 tables assigned entropy estimates to password rules, driving a generation of complexity mandates. Burr later publicly regretted that guidance, and the 2017 SP 800-63B rewrite by Paul Grassi and colleagues threw out forced complexity and rotation in favor of length, breached-password screening, and usability.
- 1948Claude ShannonDefines information entropy in bits — H = -Σ p log₂ p.
- 1951Claude ShannonEstimates the redundancy of English, foreshadowing weak human passwords.
- 2004William Burr / NISTSP 800-63 assigns entropy values to password composition rules.
- 2017Paul Grassi et al. / NISTSP 800-63B drops complexity/rotation mandates for length and breach screening.
See the full timeline of the math behind every calculator →
Runs entirely in your browser — nothing you enter leaves this page. Your recent runs are stored only on your device.