Password Entropy & Crack Time Calculator
Password Entropy & Crack Time Calculator
Enter a password to see which character types it uses (lowercase, uppercase, numbers, symbols), its entropy in bits, and the average time an attacker guessing at a given rate would need to crack it through brute force.
Entropy measures how unpredictable a password is based purely on its length and the size of the character pool it draws from — adding a symbol or a digit expands that pool and increases entropy exponentially with each added character, which is why length matters more than most people expect. It's important to read this as a brute-force estimate only: real-world attacks frequently use dictionary lists, known-password databases, and pattern-based guessing rather than pure random brute force, so a password can have decent entropy on paper and still be weak if it's a common word with a digit tacked on the end.
- Formula: Entropy = Length × log₂(Character Pool Size); Average Crack Time = Pool Size^Length ÷ (2 × Guesses Per Second).
- Runs entirely in your browser: your password is analyzed locally using JavaScript and is never sent to a server.
- This is a brute-force estimate only: real attacks often use dictionaries and pattern-matching that crack common passwords far faster than brute force would suggest — entropy is a useful signal, not a guarantee.
What guess rate should I use?
10 billion guesses/second is a reasonable estimate for a fast offline attack against a weakly-hashed password using modern GPU hardware; a properly slow-hashed password (bcrypt, Argon2) might realistically face thousands of guesses/second instead.
Why is a long password with only lowercase letters still weak?
A small character pool (just 26 letters) needs to be raised to a very high power to compensate — length helps, but mixing in numbers, symbols, and uppercase letters increases the pool size and boosts entropy much faster.
Password Entropy & Crack Time Calculator
Enter a password to see which character types it uses (lowercase, uppercase, numbers, symbols), its entropy in bits, and the average time an attacker guessing at a given rate would need to crack it through brute force.
Entropy measures how unpredictable a password is based purely on its length and the size of the character pool it draws from — adding a symbol or a digit expands that pool and increases entropy exponentially with each added character, which is why length matters more than most people expect. It's important to read this as a brute-force estimate only: real-world attacks frequently use dictionary lists, known-password databases, and pattern-based guessing rather than pure random brute force, so a password can have decent entropy on paper and still be weak if it's a common word with a digit tacked on the end.
- Formula: Entropy = Length × log₂(Character Pool Size); Average Crack Time = Pool Size^Length ÷ (2 × Guesses Per Second).
- Runs entirely in your browser: your password is analyzed locally using JavaScript and is never sent to a server.
- This is a brute-force estimate only: real attacks often use dictionaries and pattern-matching that crack common passwords far faster than brute force would suggest — entropy is a useful signal, not a guarantee.
What guess rate should I use?
10 billion guesses/second is a reasonable estimate for a fast offline attack against a weakly-hashed password using modern GPU hardware; a properly slow-hashed password (bcrypt, Argon2) might realistically face thousands of guesses/second instead.
Why is a long password with only lowercase letters still weak?
A small character pool (just 26 letters) needs to be raised to a very high power to compensate — length helps, but mixing in numbers, symbols, and uppercase letters increases the pool size and boosts entropy much faster.