A strength meter that only says "strong" or "weak" doesn't say much. Entropy in bits, on the other hand, is a concrete and comparable measure: it quantifies exactly how many possible combinations a password has, and from there you can calculate something tangible, like the estimated time it would take to crack by brute force.
What entropy in bits means
Entropy measures the amount of information, in bits, needed to represent all possible combinations of a password. Every additional bit doubles the number of possible combinations. A password with 40 bits of entropy has 2⁴⁰ possible combinations (roughly a trillion); with 60 bits, you're already talking about more than a quadrillion combinations.
The basic formula is: entropy = length × log₂(size of the character set used). If you only use lowercase letters (26 possible characters per position), each character contributes less entropy than if you use lowercase, uppercase, numbers and symbols (more than 90 possible characters per position).
Why length matters more than complexity
It's more efficient in entropy terms to add characters than to add variety of character types. Going from 8 to 12 characters (all lowercase) adds more real entropy than adding symbols to an 8-character password. This is counterintuitive against the popular belief that "more symbols = more secure", but it's what the math of combinations dictates.
How a password's real strength is measured
- Type the password you want to evaluate (it's analyzed in your browser, never sent anywhere).
- The tool calculates the entropy in bits based on its length and character variety.
- It detects common patterns that reduce the real entropy below what the theoretical calculation suggests: dictionary words, keyboard sequences, dates.
You can do it free with the password entropy calculator on this site, which never sends the password outside your browser.
Why the theoretical calculation sometimes lies
A password like P@ssw0rd123 looks like it has good theoretical entropy due to its length and character variety, but in practice it's one of the first ones any attacker tries, because obvious substitution patterns (@ for a, 0 for o) and dictionary words are in the most common attack lists. A good entropy calculator doesn't just count mathematical combinations: it also detects these patterns and adjusts the real strength estimate downward when it finds them.
From bits to "time to crack"
Entropy in bits translates directly into an estimated brute-force attack time, assuming a given computing capacity (for example, a billion attempts per second, a realistic figure for modern attack hardware):
- Under 40 bits: seconds to minutes.
- 40-60 bits: hours to months.
- 60-80 bits: years to centuries.
- Over 80 bits: practically infeasible with current technology.
Frequently asked questions
How many bits of entropy do I need to feel safe? As a general reference, 60+ bits is a good target for important passwords; for a password manager's master password, aim for 80+ bits.
Is my password sent to any server when measuring entropy? No, if you use a tool that processes in the browser; the calculation and pattern detection happen entirely locally.
Why does my password with symbols have less real entropy than a longer one without symbols? Because entropy depends more on length than on character variety; a long lowercase-only password can exceed a shorter one with symbols in possible combinations.
Does this work for passwords I already use, or only for generating new ones? It works for both cases: you can evaluate the real strength of an existing password to decide whether it's worth changing.
Measure any password's real strength for free with the entropy calculator, with pattern detection and without it ever leaving your browser.