Free Online Calculators
Password entropy & brute-force time at 10 billion attempts/s
How strong is your password, really? Gut feelings and green checkmarks don't tell the whole story. Our Password Strength Calculator goes deeper — it calculates your password's entropy in bits and estimates exactly how long it would take an attacker running 10 billion attempts per second to crack it through brute force. Whether you're a security professional, a developer, or just someone who wants to sleep better at night, this free tool gives you the hard numbers behind your password's security.
Password entropy is a measure of how unpredictable — and therefore how difficult to guess — a password is. It's expressed in bits, and the higher the number, the stronger the password. Entropy is calculated based on two factors:
The formula is straightforward: Entropy = L × log₂(N), where L is the password length and N is the size of the character pool. A password with 50 bits of entropy is considered weak by modern standards. Anything above 80 bits is generally considered strong, and 100+ bits puts you in excellent territory.
Knowing entropy in bits is useful, but translating that into real-world crack time makes it tangible. Our calculator assumes an attacker can make 10 billion (10¹⁰) password guesses per second — a realistic benchmark for a well-funded adversary using modern GPU clusters or dedicated cracking hardware. The total number of possible passwords is 2 raised to the power of your entropy value. Dividing that by 10 billion gives you the estimated crack time in seconds, which we then convert into human-readable units: seconds, minutes, hours, days, years, or even millions of years.
For example, a password with 60 bits of entropy has roughly 1.15 × 10¹⁸ possible combinations. At 10 billion attempts per second, that's about 3.7 years to exhaust on average. Bump it up to 80 bits and you're looking at over 38 million years. These numbers make the importance of entropy immediately clear.
Building a genuinely strong password isn't complicated once you understand the math. Here's what actually moves the needle:
We chose 10 billion attempts per second as the baseline because it reflects realistic, high-end offline attack speeds using modern hardware. Online attacks are much slower due to rate limiting and account lockouts, but offline attacks — where a stolen password hash is cracked locally — can reach these speeds with consumer-grade GPU rigs, and far beyond with cloud computing clusters. Benchmarking against this rate ensures you're planning for a serious threat model, not just casual attacks.
Using the Password Strength Calculator is simple and completely private — no data is sent to any server:
Because the calculation happens entirely in your browser, your password never leaves your device. Privacy-first by design.
Here's a quick reference for interpreting your entropy score:
For most personal accounts, aim for at least 70–80 bits of entropy. For highly sensitive accounts — email, banking, password managers — target 90 bits or higher.
No. The Password Strength Calculator runs entirely in your browser using JavaScript. Your password never leaves your device and is never transmitted to our servers. You can even use it offline once the page has loaded.
Because of how exponential math works. Adding one more character to your password multiplies the total number of combinations by the size of your character pool. Adding a symbol type increases the pool by a fixed amount. Length compounds; complexity adds. Both help, but length has the bigger long-term impact on entropy.
A high entropy score means your password is highly resistant to brute-force attacks. However, passwords can also be compromised through phishing, data breaches, keyloggers, or reuse across sites. Always combine a strong password with two-factor authentication (2FA) and avoid reusing passwords across services.
A brute-force attack tries every possible character combination systematically. A dictionary attack uses lists of known words, common passwords, and patterns. Our calculator estimates brute-force resistance, but using recognizable words weakens your real-world security even if your entropy score looks good.
Modern security guidance from organizations like NIST recommends changing passwords when you have reason to believe they've been compromised, rather than on a fixed schedule. Focus on using unique, high-entropy passwords for every account — ideally managed with a reputable password manager — rather than frequent rotation of weak passwords.