Type any password to see its entropy in bits, a strength rating, and estimated crack times across four real-world attack speeds. Purely client-side — nothing you type is ever sent anywhere.
| Attack Scenario | Guess Rate | Est. Time to Crack |
|---|
Start typing a password above to see its strength analysis
This password strength calculator scores any password you type using real entropy math instead of a vague "weak / medium / strong" guess. Acting as a dedicated password entropy calculator and crack time calculator, it measures how many bits of entropy a password contains, assigns a strength band from Very Weak to Very Strong, and estimates how long an attacker would need to guess it under four realistic attack scenarios — from a throttled login form at 100 guesses per hour to an offline GPU cluster testing 10 billion guesses per second. Everything runs locally in your browser, so the password you test never leaves your device.
The calculator works in two connected stages. First it scans the password for which character pools it draws from — lowercase letters (26 possibilities), uppercase letters (26), digits (10), and symbols (roughly 32) — and sums the pools actually present to get the effective character set size. It then multiplies the password length by the base-2 logarithm of that set size to get entropy in bits, so each additional character multiplies the search space even as the entropy number itself rises only linearly. That entropy value feeds the second stage: four crack-time estimates derived from the standard average-case formula expected time ≈ 2^entropy ÷ guess rate ÷ 2, using guess rates that span eleven orders of magnitude.
It's built for anyone who owns an account: developers hardening authentication flows, security engineers drafting password policies, penetration testers sizing brute-force windows, IT admins auditing legacy credentials, and everyday users curious whether the password they reuse everywhere is as strong as they think. Because it explains the math behind the rating rather than hiding it, it is also a practical teaching tool for courses and workshops that want to move beyond "add a symbol" advice.
The same password can be effectively unbreakable against a rate-limited login form yet cracked in seconds against an attacker who has stolen a database of weakly hashed passwords. Entropy is the variable that makes that spread legible: every bit doubles the number of possible passwords an attacker must try, so reasoning in bits lets you compare a 12-character passphrase against an 8-character symbol-stuffed password on the same scale. That is far more reliable than arbitrary complexity rules like "must contain a symbol", which often push users toward predictable patterns that attackers already know.
The two-step math this calculator uses to turn a password into bits and then into estimated crack times
Guess Rate is the number of guesses per second an attacker can test: 100/hour (0.0278/s) for a throttled online login, 1,000/s for an unthrottled online form, 10,000/s for an offline slow hash such as bcrypt, and 10,000,000,000/s (10 billion/s) for an offline fast hash on a GPU cluster. Dividing by 2 reflects that the average attacker finds the password halfway through the search space.
Each bit doubles the number of possible passwords. A 12-character password using all four pools (94 characters) has 12 × log₂(94) ≈ 78.7 bits — a search space of roughly 2^78.7, or about 3 × 10^23 combinations.
Online throttled (100/hr), online unthrottled (1,000/s), offline slow hash (10,000/s, bcrypt-class), and offline fast hash on a GPU cluster (10 billion/s). The same search space takes radically different wall-clock time at each rate.
Under 28 bits is Very Weak, 28–35 bits is Weak, 36–59 bits is Reasonable, 60–127 bits is Strong, and 128 bits or more is Very Strong — the thresholds this calculator uses for its color-coded strength bar.
From typing a password to exporting its full strength analysis
Enter the password you want to analyze into the Password to Analyze field. The field is masked by default, never auto-completes, and never submits — scoring starts live as you type.
The big Entropy readout shows your password's score in bits, and the color-coded strength bar fills from Very Weak (red) through Very Strong (dark green) with every keystroke.
Length, Character Pools Used, Charset Size, and Strength Band show exactly which pools the password draws from and how that translates into search-space size.
The Estimated Crack Time by Attack Speed table shows how long the password survives against throttled online, unthrottled online, offline slow-hash, and GPU-cluster attacks.
The Crack Time Across Attack Tiers chart plots all four estimates on a log scale, making the eleven-order-of-magnitude gap between attack speeds visually obvious.
Click Export Result to download a plain-text summary of the analysis, or Clear to erase the field and score a different password.
Walking through a real analysis — the password "tr0ub4dor"
Suppose a user signs up with the password tr0ub4dor — the word "troubador" with the letter "o" replaced by the digit "0". Let's follow exactly what the calculator does with it.
Explanation: The striking takeaway is how the same 46.5-bit password swings from roughly 580,000 centuries against a throttled login form to just 1.4 hours against an offline GPU cluster cracking a fast hash. That gap comes from attack speed, not from the password changing. In practice, "tr0ub4dor" is also a dictionary-root word with a predictable substitution, so pattern-based tools would crack it in a fraction of even the brute-force estimate. This is why length, randomness, and strong server-side hashing (bcrypt or argon2) all matter together.
What each entropy range and strength band means, and what to do about it
| Entropy Range | What It Generally Means | Recommended Next Step |
|---|---|---|
| Under 28 bits — Very Weak | An offline attacker cracks it in seconds to minutes | Replace it now with a longer, randomly generated password; enable MFA |
| 28 – 35 bits — Weak | Vulnerable to GPU-cluster brute force in hours to days | Lengthen it toward 60+ bits; stop reusing it across sites |
| 36 – 59 bits — Reasonable | Survives online throttling but is weak offline | Acceptable baseline; add length or use a passphrase to cross 60 bits |
| 60 – 127 bits — Strong | Years to centuries even on a 10 B/s GPU cluster | Good for most accounts; keep it unique and store it in a password manager |
| 128+ bits — Very Strong | Brute force is effectively impossible | Ideal for master passwords, encryption keys, and critical admin accounts |
If your password lands in the Reasonable band: you are in good company — it will stop casual guessing and online credential-stuffing, but it will not survive an offline attack against a stolen, weakly hashed database. The cheapest upgrade is length: adding four random characters to a 10-character password adds roughly 26 bits, taking it from about 65 to 92 bits and multiplying the search space by tens of millions.
If your password is Very Weak or Weak: don't panic — but do treat the reading as urgent. The realistic fix is a password manager generating a long random string per account, not memorizing a slightly longer version of a predictable word.
Entropy is an optimistic upper bound, not a guarantee: a mathematically strong password that appears in a breach list, or a pattern-based "strong-looking" password like "P@ssw0rd!", is far weaker than the bits suggest.
This calculator assumes random character selection and pure brute force. Real attackers use dictionary lists, keyboard-walk rules, leaked-password databases, and pattern matching, which crack most human-chosen passwords far faster than entropy math predicts. Use these numbers to compare and improve your passwords — never as a guarantee of safety.
Where measuring password entropy and crack time genuinely helps
Enforce a minimum-entropy threshold on registration so new accounts start at 60+ bits instead of the minimum-length rule users game.
Score a handful of current passwords to build a business case for moving to generated, unique credentials.
Replace arbitrary "8 chars + one symbol" rules with an entropy or passphrase target you can justify in a policy review.
Size brute-force windows for a target hash rate and decide which test accounts need stronger credentials before an engagement.
During a credential rotation, spot-check reused or exposed passwords and prioritize the weakest for forced change.
Validate that your login throttling, account lockout, and bcrypt cost factor give the protection your password policy assumes.
Verify service accounts, root or admin passwords, and SSO master credentials all reach a Strong band.
Before committing to the one password a password manager protects, confirm it exceeds 100 bits and is not a known phrase.
Show users a live entropy readout during signup to steer them toward strength instead of punishing them with rejections.
Demonstrate with real numbers how a dictionary word beats a "complex" password and why passphrases win.
Make logarithms and search spaces concrete by computing real entropy values in a classroom or workshop.
Re-score passwords created years ago — hardware improves every year, so yesterday's "strong" may be today's "weak".
What this password strength calculator does well, and where it can't replace real-world threat intelligence
Entropy and estimated crack time against a 10 B/s GPU cluster for common character sets and lengths
| Character Set | Charset Size | Length | Entropy (bits) | Strength Band | Est. Crack Time (10 B/s) |
|---|---|---|---|---|---|
| Digits only | 10 | 8 | 26.6 | Very Weak | instantly |
| Lowercase | 26 | 8 | 37.6 | Reasonable | 10 seconds |
| Lowercase + digits | 36 | 10 | 51.7 | Reasonable | 2.1 days |
| Lowercase + digits | 36 | 12 | 62.0 | Strong | 7.5 years |
| Mixed case + digits | 62 | 10 | 59.5 | Reasonable | 1.3 years |
| Mixed case + digits | 62 | 12 | 71.5 | Strong | 51 centuries |
| All four pools | 94 | 12 | 78.7 | Strong | 7,546 centuries |
| All four pools | 94 | 16 | 104.9 | Strong | 5.89e+11 centuries |
| All four pools | 94 | 20 | 131.1 | Very Strong | 4.60e+19 centuries |
Summary: The password strength calculator turns entropy math into an actionable readout — bits, a strength band, and four crack-time tiers — so you can stop relying on "must contain a symbol" rules and start comparing passwords on a real scale. For the full security workflow, pair it with the Hash Generator to inspect stored hashes and the API Rate Limit Calculator to keep online guessing slow.
Common questions about password entropy and crack time
Official guidance to complement this calculator — the references behind entropy, hashing, and rotation advice
Explore other developer & tech tools