Password Entropy Calculator
Written by Thierno Sadou Diallo, formula verified per our methodology • Last checked on 9/5/2026
A password's theoretical entropy is calculated with E = length × log2(size of the character set). A 12-character password using lowercase, uppercase, digits, and symbols reaches about 78.7 bits of entropy.
Explanation
Entropy, measured in bits, quantifies the average number of attempts needed to guess a password through pure brute force, in the worst case where the attacker only knows its length and character set: each additional bit doubles the number of possible combinations. This calculator applies the standard information-theory formula: entropy equals the password's length multiplied by the base-2 logarithm of the character set's size (26 lowercase letters, 52 with uppercase added, 62 with digits, about 94 when adding common keyboard symbols). One essential point to understand: this calculation assumes each character is chosen perfectly at random from the given set. A human-made password, even one that looks long and varied (a name followed by a year, a dictionary word with common substitutions like "@" for "a"), has real entropy far below this theoretical maximum, since attackers rely on dictionaries and common patterns rather than blind exhaustive search. This calculator therefore measures a theoretical ceiling, not the actual resistance of a specific password against a dictionary attack.
Example: a 12-character password with the full character set
Inputs
Length: 12 characters. Character set: lowercase + uppercase + digits + symbols (94 characters).
Calculation
Entropy = 12 × log₂(94) ≈ 12 × 6.5546 ≈ 78.65 bits.
Result
This password has a theoretical entropy of about 78.7 bits, assuming perfectly random character selection.
Frequently asked questions
What entropy is considered sufficient?
There's no fixed universal threshold, but an entropy of at least 60 to 80 bits is commonly recommended for a password resistant to brute-force attacks with current hardware, more for highly sensitive accounts. What matters most is using a password manager to generate long, genuinely random passwords, rather than trying to memorize a complex one.
Why does my memorable password have lower real entropy than the calculation?
Because this calculator assumes a random choice for each character within the given set. A password built from a dictionary word, a date, or a recognizable keyboard pattern is far more predictable than a truly random string of the same length: attackers try the most likely passwords first (dictionaries, previous data breaches), not every possible combination in order.
Is adding symbols more effective than making the password longer?
No: making a password longer increases entropy linearly and without limit, while widening the character set has a more limited effect (going from 62 to 94 characters only gains about 0.6 bit per character). A long password with a simple character set can have higher entropy than a short one using every character type.