Password Entropy Calculator – Measure Password Strength in Bits

What is password entropy?

You may have already encountered the word entropy when learning thermodynamics. In the context of passwords, this word signifies a measure of password strength — i.e., how effective a password is against adversaries who try to guess it or run a brute-force attack. A brute-force attack means that someone sets up a script to try all possible combinations of characters until the password is found. Such a method would eventually determine your password, provided the adversary knows the set of characters the password is built from.

So your only real defense is to use a password that would take a very long time to guess — optimally, several millions of years. The number of trials an adversary would need to guess your password is an excellent measure of password strength, and this measure is known as password entropy.

We express it in terms of bits: if a password has n bits of entropy, an attacker needs at most 2ⁿ guesses. The greater the entropy, the better the password — at least when it comes to resisting brute-force attacks. Statistically, an attacker will usually guess the password before the very last attempt, so we often take the number of guesses required for a 50% chance of success as the measure of strength. That is half the number of attempts needed for 100% certainty: on average, an attacker needs about 2ⁿ⁻¹ guesses.

How to use this password entropy calculator?

For each common symbol type — lowercase letters, uppercase letters, digits, special characters, and space — enter how many characters of that type appear in your password. Our calculator never asks you to enter the password itself, so you are 100% safe.

The calculator returns the number of bits of entropy in your password and tells you how strong it is. Using the Custom characters section, you can also add up to three custom pools and set their respective sizes — handy for non-Latin alphabets or extended symbol sets.

Password entropy formula

Here is the mathematical recipe for how to calculate password entropy:

E = log₂(R^L)

where:

• R — the size of the pool of unique characters from which the password is built; and
• L — the password length, i.e., the number of characters in the password.

Using the properties of logarithms, we can rewrite the formula as:

E = L × log₂(R)

In other words, we first find the entropy of a single character drawn from the set of R characters — which equals log₂(R) — and then multiply it by the number of characters L. If you prefer a different logarithm base, use the change-of-base formula: E = L × log(R) / log(2).

What the formula tells us immediately is that increasing either L or R strengthens the password. To make a stronger password, you must either expand the character pool or make the password longer. In particular, a longer password from a smaller pool can be just as effective as a shorter, more complex one!

How to calculate password entropy? Examples

Suppose your password is 8 characters long and uses lowercase letters, uppercase letters, and digits. The pool size is R = 26 + 26 + 10 = 62, and L = 8, so:

E = 8 × log₂(62) ≈ 8 × 5.954 ≈ 47.6 bits — reasonable, but not great.

Now take a 12-character password that also uses special characters: R = 26 + 26 + 10 + 32 = 94 and L = 12, giving E = 12 × log₂(94) ≈ 78.7 bits — strong. A four-digit PIN, on the other hand, has only R = 10 and L = 4, so E = 4 × log₂(10) ≈ 13.3 bits — very weak.

Password entropy is NOT all that matters!

Entropy assumes the attacker performs a pure brute-force search and knows nothing else about your password. In reality, attackers use dictionaries, leaked-password lists, and predictable patterns (like Password1! or qwerty123). A password can have high theoretical entropy yet still be trivial to guess if it is a common word or a well-known substitution. For real security:

• Prefer long passphrases of random, unrelated words.
• Never reuse passwords across sites.
• Use a password manager to generate and store truly random strings.
• Enable two-factor authentication wherever possible.

FAQs

How many bits of entropy is a good password?

As a rule of thumb: below 28 bits is very weak, 28–35 is weak, 36–59 is reasonable, 60–127 is strong, and 128 bits or more is very strong.

Does the calculator store my password?

No. You only enter how many characters of each type your password has — never the password itself — so there is nothing sensitive to store.

Why does adding one more character help so much?

Because entropy grows linearly with length: each extra character adds log₂(R) bits. Adding one character to a 94-symbol-pool password adds about 6.6 bits — multiplying the number of possible passwords by 94.