Enter the number of independently chosen characters, the number of symbols available for each choice, and an assumed guesses-per-second rate. A 62-symbol alphabet can contain 26 lowercase letters, 26 uppercase letters and ten digits. Use the actual selection pool rather than counting which character types happen to appear in one password.
The rate is a scenario input; it does not identify the protection used by a particular account.
Entropy from password length
| Password length | 14 |
|---|---|
| Character set used | Lowercase + uppercase + digits (62) |
| Attacker's guessing speed | Offline, fast hash on a GPU (10 billion/sec) |
| Entropy | 83.4 |
| Estimated average crack time | 19649417.9 years |
Password Entropy: formula
Predictable words, dates and substitutions change the candidate probabilities, so the uniform-pool calculation no longer describes the attack. An exposed password can be tried directly on another account without searching this space. Hash cost, rate limits and multifactor authentication affect the attack but are not inputs in this estimate.
Common error: Reusing a randomly chosen password. Entropy models guessing effort; it does not prevent reuse of a password exposed in another account’s breach.
Password Entropy: changing Password length
| Password length | Entropy | Estimated average crack time |
|---|---|---|
| 11 | 65.5 | 82.4 years |
| 13 | 77.4 | 316926.1 years |
| 14 (example) | 83.4 | 19649417.9 years |
| 15 | 89.3 | 1218263912.6 years |
| 17 | 101.2 | 4683006479933.6 years |
Password Entropy: compare input ranges
| Input | Tested from | To | Entropy: low input | Entropy: high input | Swing |
|---|---|---|---|---|---|
| Character set used | Lowercase letters only (26) | Lowercase + uppercase + digits + symbols (94) | 65.8 | 91.8 | 26 (31%) |
| Password length | 13 | 15 | 77.4 | 89.3 | 11.9 (14%) |
Password Entropy: individual input comparisons
| Input | Value | Entropy | Estimated average crack time |
|---|---|---|---|
| Password length | 11 | 65.5 | 82.4 years |
| 13 | 77.4 | 316926.1 years | |
| 14 | 83.4 | 19649417.9 years | |
| 15 | 89.3 | 1218263912.6 years | |
| 17 | 101.2 | 4683006479933.6 years | |
| Character set used | Lowercase letters only (26) | 65.8 | 102.2 years |
| Lowercase letters + digits (36) | 72.4 | 9729.7 years | |
| Lowercase + uppercase letters (52) | 79.8 | 1674606.8 years | |
| Lowercase + uppercase + digits (62) | 83.4 | 19649417.9 years | |
| Lowercase + uppercase + digits + symbols (94) | 91.8 | 6662787889.0 years | |
| Attacker's guessing speed | Online, rate-limited login (100/sec) | 83.4 | 1964941794473839.3 years |
| Offline, slow hash e.g. bcrypt (10,000/sec) | 83.4 | 19649417944738.4 years | |
| Offline, fast hash on a GPU (10 billion/sec) | 83.4 | 19649417.9 years | |
| Offline, specialized cracking hardware (100 billion/sec) | 83.4 | 1964941.8 years |
Password Entropy: values and definitions
| Quantity and definition | Value used |
|---|---|
| Password length — Total number of characters in the password. | 14 |
| Character set used — What kinds of characters the password draws from. | Lowercase + uppercase + digits (62) |
| Attacker's guessing speed — How fast an attacker can try candidate passwords. | Offline, fast hash on a GPU (10 billion/sec) |
| Entropy | 83.4 |
| Estimated average crack time | 19649417.9 years |
Entropy converts a password into a single comparable number, the base-2 logarithm of how many equally likely passwords could occupy the same length and character pool, which is what determines how long an exhaustive search takes; two very different-looking passwords with the same entropy are equally hard to brute-force.
Check the estimate against a guessing speed that matches the real threat: a rate-limited login form and an offline database of stolen password hashes are separated by many orders of magnitude, and quoting one crack time while assuming the other scenario is a common way this number gets misused.
See how long a transfer of a large file takes on the download time calculator, the unit sizes on the storage converter and the network block sizes on the subnet calculator. The bandwidth page estimates monthly data use, and the aspect ratio calculator covers screen sizing.
Understand the quantities in this calculation
Does 80 bits mean every account is safe?
No. This model assumes independent uniform random characters and a stated guessing rate. Reuse, phishing and exposed passwords are outside it.
What does current NIST guidance require?
SP 800-63B-4 requires at least 15 characters for a password used alone, or at least 8 when used as part of multifactor authentication. A modeled entropy value is not that compliance check.