How to use the Password Strength
- Enter the password length you are considering.
- Select the character sets in use — lowercase, uppercase, digits, symbols.
- Read the entropy in bits and the estimated time to crack offline.
- Compare a longer passphrase against a short complex string to see the difference.
How the calculation works
Entropy assumes a random password and equals length × log₂(pool size). A 10-character password from a 62-character alphanumeric pool carries about 59.5 bits; adding symbols raises the pool to 95 and gives 65.7 bits, while simply adding four more alphanumeric characters gives 83.4. Because length is a multiplier and pool size only a logarithm, extending a password always outperforms adding character classes.
Real-world passwords are rarely random, and that is the calculation's limit. Dictionary words, names, dates and predictable substitutions such as 'a' to '@' reduce effective entropy far below the theoretical figure, because attackers search patterns before brute force. Crack-time estimates also depend on how the site stores the hash: a fast unsalted hash falls in seconds, while a properly configured bcrypt or Argon2 hash is orders of magnitude slower to attack.
Entropy bits = length × log₂(character pool size) ; guesses ≈ 2^bits ; time = guesses / guesses per secondSource: NIST SP 800-63B Digital Identity Guidelines, which prioritise length and screening against breached passwords over composition rules.
Worked example
Comparing 'Xk7!qR2z' (8 characters, all classes) with 'copper-lantern-drift-92' (23 characters, lowercase, digits and hyphen).
- First: log₂(95) = 6.57 bits per character × 8 = 52.6 bits.
- Second: pool of 37 gives log₂(37) = 5.21 bits × 23 = 119.8 bits.
- At 100 billion guesses per second, 52.6 bits falls in under an hour.
The long passphrase carries more than twice the entropy and is also easier to remember, despite using fewer character types.
Frequently asked questions
Is a longer password better than a more complex one?+
Yes. Each additional character multiplies the search space, while adding a character class only widens the base. A memorable four-word passphrase beats a short string of symbols.
Does high entropy mean my account is safe?+
No. Entropy measures guessing resistance only. A strong password that has appeared in a breach, been phished or been reused elsewhere is already compromised — hence unique passwords and two-factor authentication.
Do forced periodic password changes help?+
Current NIST guidance advises against routine expiry, because it pushes people towards predictable increments. Change a password when there is evidence of compromise instead.
Are the crack-time estimates reliable?+
They are order-of-magnitude only. Actual speed depends on the hashing algorithm, its work factor, whether the hash is salted, and the attacker's hardware — which is why the figures vary by many orders of magnitude between sites.
Last reviewed August 31, 2026. We review this page whenever the underlying formula, tax year, published rate or standard changes.