The Entropy Formula
Password entropy is a measure of unpredictability, expressed in bits:
entropy = log₂(poolSize) × lengthWhere:
poolSize= number of unique characters the password could use (based on which character classes are present)length= number of characters in the passwordlog₂= logarithm base 2
Higher entropy means more guesses a brute-force attack would need on average to crack the password.
Character Pools
The calculator counts which character classes appear in the password and sums the pool sizes:
| Character class | Characters | Pool size |
|---|---|---|
| Lowercase letters | a–z | 26 |
| Uppercase letters | A–Z | 26 |
| Digits | 0–9 | 10 |
| Symbols | Standard printable non-alphanumeric ASCII | 32 |
A password using all four classes has a pool of 26 + 26 + 10 + 32 = 94 characters.
Worked Example
Password: Tr0ub4dor3! (11 characters)
- Has lowercase (t, r, u, b, d, o, r): pool includes 26
- Has uppercase (T): pool includes 26
- Has digits (0, 4, 3): pool includes 10
- Has symbols (!): pool includes 32
- Total pool: 26 + 26 + 10 + 32 = 94
entropy = log₂(94) × 11
= 6.555 × 11
= 72.1 bitsNo pattern deductions apply (no all-same, digits-only, or keyboard-row pattern), so effective entropy = 72.1 bits → Strong.
Strength Tiers
| Entropy (bits) | Tier |
|---|---|
| < 28 | Very Weak |
| 28–35 | Weak |
| 36–59 | Fair |
| 60–79 | Strong |
| ≥ 80 | Very Strong |
These thresholds correspond roughly to the time an offline attack with a modern GPU cluster would need to crack a password at each entropy level.
Pattern Deductions
The calculator applies entropy multipliers for patterns that make brute-force much faster in practice:
| Pattern detected | Multiplier |
|---|---|
All characters identical (e.g. aaaaaa) | × 0.5 |
All digits only (e.g. 123456) | × 0.8 |
Keyboard row sequence (e.g. qwerty, 12345) | × 0.7 |
These multipliers reduce the effective entropy to reflect how real password crackers use word lists, keyboard patterns, and common substitutions.
What Entropy Levels Mean in Practice
A password with:
- 28 bits — crackable in seconds by any attacker with a modern GPU
- 40 bits — crackable in minutes to hours offline
- 60 bits — would take years with a single high-end GPU
- 80 bits — impractical to crack with current hardware even with massive clusters
However, entropy-only estimates are optimistic because they do not account for dictionary attacks. A password like correct horse battery staple is 29 characters and has very high entropy (~111 bits), but any password made of common English words is vulnerable to dictionary attacks that don’t try every possible character combination.
Limitations of This Calculator
No dictionary check. The entropy method does not compare against known password lists (such as “rockyou.txt” with 14 million common passwords). The word “Password1!” scores reasonably on entropy but is on every cracker’s list.
Context-blind. The calculation doesn’t know if you’re protecting a bank account or a disposable signup. A 40-bit entropy password might be fine for a low-stakes account but completely inadequate for anything sensitive.
Best practice recommendation. Use a password manager to generate 16+ character random passwords for every account. These achieve 80+ bits of entropy and are not susceptible to dictionary attacks.