How this instrument works
Treat a password as a string drawn uniformly at random from a fixed set of possible symbols, and information theory gives a precise measure of how unpredictable it is: its entropy in bits, equal to the password's length multiplied by the base-2 logarithm of the character set size. Each additional character multiplies the number of possible passwords by the size of the character set, and since entropy is a logarithm of that count, length and character-set size both push the bit count up, just on different scales.
The character set size is where most of the real-world variation lives. A PIN drawn only from digits has a character set of 10; an all-lowercase password draws from 26; mixing in uppercase, digits and common symbols pushes the usable set toward 94, the full range of easily typed printable ASCII characters. Doubling the character set only adds one bit of entropy per character, but adding characters adds a fixed number of bits each — which is why security guidance consistently favors longer passwords over more exotic character requirements.
This is a theoretical ceiling, not a guarantee. The formula assumes every password of that length and character set is equally likely, which is true for output from a proper random password generator but false for anything a human picks by hand — real people reuse patterns, dictionary words and predictable substitutions that a brute-force entropy estimate cannot see, so a human-chosen password with a high calculated entropy can still be far easier to guess than the number suggests.
- Enter Password length (characters) — the total number of characters in the password.
- Enter Character set size — how many distinct symbols could appear in each position: 26 for lowercase only, 62 for mixed-case alphanumeric, 94 for the full printable-ASCII keyboard set.
- Read Entropy (bits) — higher is stronger against a pure brute-force guessing attack, assuming every character was chosen uniformly at random.
- Compare candidate password shapes side by side — a longer alphanumeric password can carry more entropy than a shorter password stuffed with symbols.
Worked example — a 12-character full-ASCII password
Enter 12 for password length and 94 for character set size — a 12-character password drawn randomly from the full range of printable ASCII characters, including uppercase, lowercase, digits and symbols. log2(94) works out to roughly 6.5546 bits per character.
Multiplying by the 12-character length, Entropy (bits) reads 78.66 bits. That comfortably clears the 80-bit range security guidance often treats as strong for an offline-attack-resistant password, though it still falls short of the roughly 128-bit entropy considered effectively unbreakable by brute force with current computing power.
Questions
What is password entropy?
Password entropy is a measure, in bits, of how many guesses a brute-force attacker would need on average to find a password, assuming it was chosen uniformly at random from a known set of characters. It's calculated as length times the base-2 logarithm of the character set size — a 12-character password from a 94-symbol set has 78.66 bits of entropy, meaning roughly 2^78.66 possible combinations.
How many bits of entropy is considered a strong password?
There's no single hard cutoff, but security discussions commonly treat 80 bits and above as strong against realistic brute-force attacks, and around 128 bits as effectively unbreakable with current computing power. A 12-character password from the full 94-character printable-ASCII set already reaches about 78.66 bits, close to that 80-bit mark.
Does adding length or adding character variety help more?
Length helps more, character by character. Every additional character multiplies the number of possible passwords by the character set size, adding a fixed number of bits regardless of how large that set already is, while expanding the character set from, say, 62 to 94 only adds about 0.6 bits per character. A longer password from a modest character set usually beats a shorter one stuffed with symbols.
Why can a high-entropy password still be weak in practice?
Because the entropy formula assumes every password of that length and character set is equally likely to be chosen, which only holds for passwords generated by a proper random process. A human-picked password built from a dictionary word, a keyboard pattern or a predictable substitution can score a high calculated entropy while still being one of the first guesses a real attacker's dictionary or pattern-based tool would try.
What character set size should I use for an alphanumeric password?
Use 62 for a password mixing uppercase letters, lowercase letters and digits (26 + 26 + 10), 26 for lowercase letters only, 10 for digits only, or 94 for the full range of easily typed printable ASCII characters, which adds common symbols like !, # and % on top of mixed-case alphanumerics.
Does current NIST guidance recommend scoring passwords by entropy like this?
No, not for policy purposes. This calculator uses the classic Shannon entropy formula (H = length x log2(character set size)), a theoretical measure of guessability against pure brute force. But NIST SP 800-63B, the current federal digital-identity guideline, explicitly recommends against composition rules and entropy-style scoring, favoring a length minimum plus checking passwords against breached-password lists instead -- research found entropy estimates correlate poorly with real-world guessability. The bits figure here is still a useful ceiling for random, machine-generated passwords; it just isn't how modern NIST guidance sets password policy.