Password Strength Calculator
Estimate how long a brute-force attack would take to crack your password. See entropy in bits and get actionable strengt
Password Analysis
Your password is analyzed locally and never sent to any server
Privacy Notice
All password analysis is performed locally in your browser. No passwords are transmitted or stored.
Password Strength
Score: 0/100
Time to Hack
Brute force estimate
Entropy
Randomness measure
Complexity Analysis
Weaknesses
- ✗ No password entered
Suggestions
- • Enter a password to analyze
How it works
Password strength is measured by entropy — the number of guesses needed to crack it, in bits. Entropy grows with both length and the size of the character set (lowercase, uppercase, digits, symbols). More bits means exponentially more guesses.
Password entropy
Entropy (bits) = length × log₂(character-set size)
- length
- number of characters
- set size
- pool of possible characters (e.g. 95 for all keyboard chars)
Worked example
- 12 characters
- Mixed-case + digits + symbols (~95 options each)
- Entropy = 12 × log₂(95)
- ≈ 12 × 6.57
≈ 79 bits — strong against brute force.
Good to know
- Length beats complexity: a long passphrase often outscores a short, gnarly password.
- Real-world strength drops if the password is a common word or pattern — attackers try those first.
- Aim for 70+ bits for important accounts, and use a password manager so length isn't a burden.
Can't find the exact calculator you need?
Describe it in one sentence — get a working, math-verified calculator in seconds. Free, no signup.
Build your own calculatorRelated Calculators
Frequently Asked Questions
What makes a password strong?
Length matters most, followed by the variety of characters used. Each extra character multiplies the number of possible combinations, so a 16-character password is exponentially harder to crack than a 10-character one with the same character set.
What is password entropy?
Entropy measures unpredictability in bits: log2 of (character-set size raised to the password length). Around 60 bits resists casual attacks, while 80+ bits is considered strong against offline cracking with modern hardware.
Are passphrases better than complex short passwords?
Usually yes. Four or five random, unrelated words (like a diceware passphrase) are both easier to remember and higher in entropy than a short string of letters, digits, and symbols.
How fast can attackers actually crack passwords?
Offline attacks with GPU rigs can test billions of guesses per second against stolen hash databases. An 8-character password using every character type can fall in hours, while each added character multiplies the cracking time dramatically.
Should I use a password manager?
Yes — reusing passwords is the biggest real-world risk, since one breached site exposes every account sharing that password. A manager generates and stores a unique random password per site, so you only memorize one strong master passphrase.