Password Entropy Calculator with Brute-Force Crack Time

Real-world use cases

• Decide how long your next password needs to be

  You are setting a master password and want it to outlast offline GPU cracking. Type candidate lengths, watch the entropy and the 1e12 per second crack time climb, and stop when the offline estimate crosses centuries. A 16-character mix of all four classes clears 100 bits and reads as effectively uncrackable by brute force, which tells you the length to commit to before you save it in your manager.

• Sanity-check a generated password before trusting it

  A generator hands you a string and claims it is strong. Paste it in and read the bits directly instead of taking the badge on faith. If a 14-character output only shows 60 bits, the generator is drawing from a narrow pool; if it shows 90 plus, the keyspace is genuinely wide. The combination count and detected character classes confirm what the generator actually used.

• Explain password math to a team or a class

  You are walking colleagues through why length beats complexity. Show an 8-character symbol-heavy password next to a 20-character all lowercase one: the longer, simpler password wins on entropy every time. The live bits readout and the four attacker speeds turn an abstract argument into numbers people can see move as you edit the input.

• Set a minimum-entropy policy for an application

  You need a number for a sign-up rule, not a vague "strong" label. Test the kinds of passwords your users will actually pick, read the bits, and pick a floor, say 50 bits at registration. The crack-time rows show what that floor buys you against each attacker class so the policy is grounded in time, not vibes.

Common pitfalls

• Reading the entropy as a guarantee. The number assumes the password is random across its pool. A dictionary word or a name plus a year reports high bits but falls to a wordlist in seconds. The bits are an upper bound for a truly random string, not a verdict on the password you chose.

• Chasing complexity instead of length. Adding one symbol to an 8-character password barely moves the bits, but adding 4 more random characters can add over 25 bits. Length is the cheapest entropy. A long all-lowercase passphrase beats a short symbol-stuffed one almost every time.

• Trusting the online attack row for stored hashes. The 1e3 per second figure models a throttled login, not a leaked database. If the password hash is stolen, the relevant rows are the offline ones at 1e9 to 1e15, which can be a billion times faster, so judge resistance by those.

Privacy