Free Online Calculators
Password entropy & brute-force time at 10 billion attempts/s
This calculator rates your password's strength by computing its entropy โ the total number of possible character combinations an attacker would have to try. It then estimates how long a brute-force attack running at 10 billion attempts per second would take to crack it. Use it to instantly see whether your password is truly secure.
Enter it into a strength checker that estimates entropy from length and character variety and compares it against known breach lists and dictionary patterns. Entropy in bits and an estimated cracking time tell you more than a simple "weak/strong" label, since a long passphrase usually beats a short password full of symbols.
The 8 4 rule says a password must have at least eight characters and use all four character types: uppercase letters, lowercase letters, digits and special characters. It is a minimum policy, not a guarantee โ eight characters are crackable today, so longer is better.
A good password reaches enough entropy that offline brute force becomes impractical, which in practice means a long passphrase of several unrelated words or a random string well beyond the usual eight-character minimum. Uniqueness matters just as much: a high-entropy password that was reused on a breached site is already compromised.
The best checker is one that runs locally in your browser, never sends the password anywhere, and scores it with pattern matching rather than a simple character-class count. Open-source engines like zxcvbn work this way, recognising dictionary words, keyboard walks, dates and leetspeak substitutions.
Strong passwords are ones nobody has published โ for example, random multi-word passphrases ("copper-lantern-drift-oyster") or random character strings from a generator, each unique per account. Never take an example from a webpage as your actual password; use the pattern and generate your own.
How strong is your password, really? Gut feelings and green checkmarks don't tell the whole story. Our Password Strength Calculator goes deeper โ it calculates your password's entropy in bits and estimates exactly how long it would take an attacker running 10 billion attempts per second to crack it through brute force. Whether you're a security professional, a developer, or just someone who wants to sleep better at night, this free tool gives you the hard numbers behind your password's security.
Password entropy is a measure of how unpredictable โ and therefore how difficult to guess โ a password is. It's expressed in bits, and the higher the number, the stronger the password. Entropy is calculated based on two factors:
The formula is straightforward: Entropy = L ร logโ(N), where L is the password length and N is the size of the character pool. A password with 50 bits of entropy is considered weak by modern standards. Anything above 80 bits is generally considered strong, and 100+ bits puts you in excellent territory.
Knowing entropy in bits is useful, but translating that into real-world crack time makes it tangible. Our calculator assumes an attacker can make 10 billion (10ยนโฐ) password guesses per second โ a realistic benchmark for a well-funded adversary using modern GPU clusters or dedicated cracking hardware. The total number of possible passwords is 2 raised to the power of your entropy value. Dividing that by 10 billion gives you the estimated crack time in seconds, which we then convert into human-readable units: seconds, minutes, hours, days, years, or even millions of years.
For example, a password with 60 bits of entropy has roughly 1.15 ร 10ยนโธ possible combinations. At 10 billion attempts per second, that's about 3.7 years to exhaust on average. Bump it up to 80 bits and you're looking at over 38 million years. These numbers make the importance of entropy immediately clear.
Building a genuinely strong password isn't complicated once you understand the math. Here's what actually moves the needle:
We chose 10 billion attempts per second as the baseline because it reflects realistic, high-end offline attack speeds using modern hardware. Online attacks are much slower due to rate limiting and account lockouts, but offline attacks โ where a stolen password hash is cracked locally โ can reach these speeds with consumer-grade GPU rigs, and far beyond with cloud computing clusters. Benchmarking against this rate ensures you're planning for a serious threat model, not just casual attacks.
Using the Password Strength Calculator is simple and completely private โ no data is sent to any server:
Because the calculation happens entirely in your browser, your password never leaves your device. Privacy-first by design.
Here's a quick reference for interpreting your entropy score:
For most personal accounts, aim for at least 70โ80 bits of entropy. For highly sensitive accounts โ email, banking, password managers โ target 90 bits or higher.
No. The Password Strength Calculator runs entirely in your browser using JavaScript. Your password never leaves your device and is never transmitted to our servers. You can even use it offline once the page has loaded.
Because of how exponential math works. Adding one more character to your password multiplies the total number of combinations by the size of your character pool. Adding a symbol type increases the pool by a fixed amount. Length compounds; complexity adds. Both help, but length has the bigger long-term impact on entropy.
A high entropy score means your password is highly resistant to brute-force attacks. However, passwords can also be compromised through phishing, data breaches, keyloggers, or reuse across sites. Always combine a strong password with two-factor authentication (2FA) and avoid reusing passwords across services.
A brute-force attack tries every possible character combination systematically. A dictionary attack uses lists of known words, common passwords, and patterns. Our calculator estimates brute-force resistance, but using recognizable words weakens your real-world security even if your entropy score looks good.
Modern security guidance from organizations like NIST recommends changing passwords when you have reason to believe they've been compromised, rather than on a fixed schedule. Focus on using unique, high-entropy passwords for every account โ ideally managed with a reputable password manager โ rather than frequent rotation of weak passwords.