Formula
Entropy = length × log₂(number of possible symbols). On average an attacker finds the password after trying half of all combinations, so time = 2^(bits − 1) ÷ guesses per second.
Examples
- 12 random characters with symbols: 78.7 bits, about 754,000 years against 10 billion guesses per second.
- 8 random characters: 52.4 bits, only about 4 days at that speed.
- 6 random words from a 7,776-word list: 77.5 bits, and much easier to remember.
Good habits
- Use a password manager and a different password for every site.
- Turn on two-step verification on important accounts.
- Never reuse a password that appeared in a data breach.
Frequently asked questions
Why does my “P@ssw0rd2024” look strong but is not?
The calculation assumes random choices. Common words with swaps and years are in every attacker’s list and fall in seconds.
Is it safe to use this page?
Yes. It only asks for the length and kind of characters, never the password, and nothing is sent anywhere.
See also
Results are estimates for information only and are not financial, legal or medical advice. Rates, taxes and fees vary — confirm with a professional or your lender.