BYTETOOLS

Password Entropy Calculator

Measure a password's entropy in bits from its character pool and length, then see estimated crack times for five different attackers. Runs locally.

What is the Password Entropy Calculator?

Password entropy is the number of bits of randomness in a password, calculated as its length multiplied by the base-2 logarithm of the character pool it was drawn from. Every extra bit doubles the number of guesses an attacker needs.

  • Exact log₂ entropy calculation with the character pool shown
  • Optional pattern penalties for dictionary words, repeats and keyboard runs
  • Crack-time estimates for five attacker speeds, from throttled login to GPU cluster
  • Passphrase mode with Diceware, EFF and BIP-39 word list sizes
  • Full working shown — no black-box score
  • Nothing is uploaded; the password never leaves your browser

How to use the Password Entropy Calculator

  1. 1

    Switch between Password and Passphrase mode depending on what you are measuring.

  2. 2

    Type the password, or set the number of words and the word list size.

  3. 3

    Read the entropy in bits and the strength band it falls into.

  4. 4

    Compare the estimated crack times across the five attacker profiles.

  5. 5

    Open the working panel to see the character pool and every penalty applied.

About the Password Entropy Calculator

The ByteTools Password Entropy Calculator quantifies how much randomness a password actually contains. It detects which character sets you used, multiplies the length by log₂ of the resulting pool, and shows the working so you can see exactly where the number came from.

It also applies optional pattern penalties for the habits that make a password far weaker than its raw bit count suggests — dictionary words, a word followed by digits, repeated characters and keyboard runs — and converts the result into estimated crack times for five realistic attackers, from a rate-limited login form to a large GPU cluster.

A separate passphrase mode does the dice-roll maths instead: choose a word list size and a word count and see the entropy of a randomly generated phrase. Everything is computed in your browser and nothing you type is uploaded, logged or remembered.

Frequently asked questions

How is password entropy calculated?

Entropy in bits equals the length multiplied by the base-2 logarithm of the character pool size. A 12-character password using lowercase, uppercase and digits draws from a pool of 62, so it scores 12 × log₂(62), which is about 71.5 bits.

How many bits of entropy is enough?

Under 28 bits is trivially broken and 60 bits is a reasonable floor for anything that matters. Aim for 80 bits or more for accounts protecting money or identity, and 128 bits if the password is also an encryption key.

Why does 'correcthorsebatterystaple' score so high here?

Because the formula assumes each character was chosen at random from the pool, giving about 117 bits for 25 lowercase letters. Chosen as four random words from a 2,048-word list it is really about 44 bits — which is what the passphrase mode reports, and why the two numbers differ.

Are the crack-time estimates accurate?

They are order-of-magnitude guides, not predictions. Real speed depends on the hashing algorithm the target uses, the attacker's hardware and whether your password appears in a leak. Treat a long estimate as necessary but not sufficient.

Is entropy the same as password strength?

Not quite. Entropy measures randomness assuming a random choice; strength also depends on whether the password has already been breached, reused elsewhere or follows a predictable pattern. That is why the pattern penalties exist here.

Does adding a symbol really help?

It helps, but less than length does. Adding one symbol widens the pool from 62 to 94, worth about 0.6 extra bits per character. Adding four more characters to a 12-character password is worth over 26 bits — length wins every time.

Related tools