Password Entropy Calculator

Password entropy is a measure of how many possible passwords a given password format could produce, expressed in base-2 logarithm (bits). A password with N bits of entropy has 2ᴺ possible values. For example, a 16-character password using all character types (pool size 94) has 2¹⁰⁵ possible combinations, making brute-force practically infeasible on modern hardware.

The formula is: entropy (bits) = length × log₂(pool size). Pool size is determined by which character types are used: lowercase (26) + uppercase (26) + digits (10) + symbols (32) = 94 printable ASCII characters. This formula assumes each character is independently and uniformly drawn from the pool, which is exactly what a cryptographic random password generator guarantees.

Note: For human-chosen passwords, the effective entropy is much lower than the formula suggests, because humans use predictable patterns that reduce the realistic search space.

Current guidance: 60 bits is a minimum for important accounts; 80 bits is strongly recommended for high-value accounts (email, banking, cloud storage). A randomly generated 12-character password with all types achieves ~79 bits; 16 characters achieves ~105 bits, well above any realistic threat for most users.

Entropy measures resistance to brute-force attacks only. It does not account for: (1) dictionary attacks on non-random passwords, (2) credential stuffing using previously breached passwords, (3) phishing (which bypasses cryptographic strength entirely), or (4) the hash algorithm used by the site storing your password. A high-entropy password stored in a poorly secured site with plain-text storage is still vulnerable regardless of its bits.