Password Entropy Calculator

The calculation

For independent uniform selections, combinations equal pool sizelength and entropy equals length × log2(pool size). The result is mathematically meaningful only when the generation process is uniform and the pool assumption is correct.

Why human passwords differ

People choose patterns, words, substitutions and personal references. Those choices are not uniform, so applying this formula to a typed password can seriously overstate its resistance. Use the pattern-aware strength checker for human-created passwords.

Context still matters

Online rate limits, MFA, credential reuse, phishing and the service’s password-hashing design change real attack cost. OWASP Password Storage Cheat Sheet explains why slow, salted password hashing matters after a database breach.

When should you use the entropy calculator?

Use it to compare two documented random-generation policies, not to rate a real password you typed. It can show how length changes a fixed pool, how excluding ambiguous characters affects combinations, or what pool size is needed for a random identifier.

If the creation process is unknown or human-selected, use the pattern-aware strength checker and treat its result as an estimate.

How to interpret bits and combinations

One additional bit doubles the number of equally likely outcomes. Combinations show the complete space; bits make large spaces easier to compare. Neither number includes account rate limits, MFA, password reuse, phishing or server-side hashing.

Do not convert the result to a crack-time claim without declaring a guess rate and whether the attack is online or offline.

Common entropy mistakes

• Counting every visible character as uniformly random when a person chose the string.
• Adding bits for fixed punctuation or predictable capitalization.
• Assuming the full pool when a service silently rejects characters.
• Quoting worst-case exhaustive time as the expected result.
• Ignoring reuse, which allows direct login without guessing.