Password Entropy Calculator
See how strong a password really is — using a realistic cracking model, not just a character-count — with crack times, the weaknesses that drag it down, and why length and unpredictability matter.
Type or paste a password and this page estimates its strength the way an attacker would attack it: it breaks the password into the pieces a smart cracker targets — dictionary words, keyboard and number sequences, repeated characters, dates and l33t substitutions — and works out how many guesses it would actually take, rather than assuming every character is an independent random pick. You get the entropy in bits, a strength rating, crack times at five real-world attack speeds, and a plain-English explanation of every weakness it finds.
Your password
Tip: it is safe to test a password you are considering — you do not need to test a live one. If you do, treat this page like any other: clear the field (or close the tab) afterwards.
Realistic vs “character-set” entropy
Most password meters report character-set entropy: they look at which kinds of characters you used (lowercase, uppercase, digits, symbols) and multiply that pool size by the length. That number assumes every position is an independent random draw. Real passwords are not random — they contain words, sequences and habits — so a smart attacker needs far fewer guesses than the character-set number suggests. The gap between the two is how much “pattern” your password gives away.
| Measure | Value | What it assumes |
|---|---|---|
| Realistic entropy (this tool) | — | A smart cracker: dictionary + pattern rules + brute force. |
| Character-set entropy (typical meters) | — | Every character is an independent random pick from the pool you used. |
| Pattern penalty | — | How many bits of strength the patterns in your password cost you. |
Estimated time to crack
Time to crack depends on the hash the site stores and the attacker’s hardware. Slower, salted hashes (bcrypt, Argon2, scrypt) make every guess expensive and are the single biggest defence; fast hashes (MD5, SHA-1) can be tried billions of times per second on a GPU. “Expected” is the average case (half the search space); “worst case” is the full space.
| Attack speed | Expected (50%) | Worst case (100%) |
|---|
What the model found
The password is split into the pieces a cracker would target, in order. Each piece’s “guesses” is how many attempts the model thinks that piece costs; the total is the product of all the pieces.
Why length and unpredictability beat complexity
Entropy is the size of the search space, measured in bits. One bit doubles the number of possibilities an attacker must try. A password with 40 bits of entropy has a search space of about a trillion guesses; one with 80 bits has a trillion trillion (1024). Each bit you add is a genuine doubling of the work, which is why strength grows so fast with length.
Length multiplies; one extra symbol barely adds. Adding a character to a password
multiplies the search space by the pool size (roughly 26–90×). Adding a single symbol to
an otherwise-weak password does not fix the underlying pattern — it just nudges the pool size
up. That is why Password1! is only marginally better than Password1, while
a 16-character password is dramatically stronger than an 8-character one even with the same mix of
character types.
Unpredictability is what actually matters. A password’s real strength is how
hard it is to guess the sequence you chose, not how many character types it contains.
Dictionary words, keyboard walks (qwerty), number runs (123), repeats
(aaa), dates and l33t swaps (p@ssw0rd) are all patterns a cracker tries
first, and each one collapses a large chunk of the search space. Two passwords of the same length and
the same character mix can differ by tens of bits of real strength purely because of their patterns.
Long and random beats short and complex. Four unrelated random words (“correct horse battery staple”) carry roughly 40–60 bits and are memorisable, while a short all-caps-and-symbols string can sit under 30 bits because it is built from a guessable word. If you want a strong password you can remember, go long and unpredictable; if you want maximum strength with no memory burden, use a random string from a password manager.
Common weaknesses and why they hurt
| Weakness | Example | Why it weakens the password |
|---|---|---|
| Common password | password, 123456 | These top the list of every breach and are tried within the first few guesses of any attack. |
| Dictionary word | dragon, sunshine | Crackers run dictionaries of common words first, so a word is worth far fewer guesses than its length suggests. |
| Sequence | 123, abc, qwe | Sequential and keyboard runs are among the very first patterns tried, and cost only a handful of guesses. |
| Repeat | aaa, 111 | Repeating one character adds almost no new information — the cracker only has to guess the character once. |
| Date / personal info | 1990, 07/04 | Birth years, anniversaries and the like are standard guesses, especially when combined with a name. |
| L33t substitution | p@ssw0rd, T3st | Swapping symbols for letters is a well-known, easily reversed trick — it adds almost no real entropy. |
How to make a stronger password
- Go long: 12+ characters, or 4+ unrelated words for a passphrase you can remember.
- Make it unpredictable: avoid words, sequences, repeats, dates and personal information.
- Use a different password for every account, stored in a password manager.
- Turn on multi-factor authentication — it protects you even if a password is ever compromised.
Nothing on this page leaves your browser: there is no server round-trip when you type, no analytics on your input, and no storage of any kind. The word and password lists used by the model ship with this page and run entirely in your browser.
Suggested
