Password Strength Checker

Password strength is measured mathematically using entropy, a measure of unpredictability expressed in bits. The higher the entropy, the longer it would take an attacker working through every combination to guess the password.

The entropy formula:

Entropy (bits) = log₂(Character Set Size) × Password Length

Or equivalently:

Entropy (bits) = Password Length × log₂(N)

Where N is the number of possible characters in the pool being used.

Character set sizes:

Worked examples:

• “password” (8 lowercase, pool 26): 8 × 4.70 = 37.6 bits, about 10 seconds
• “P@ssw0rd!” (9 chars, pool 95): 9 × 6.57 = 59.1 bits, just under a year

Time-to-crack benchmarks. Times below assume 10 billion guesses per second, which is a single modern GPU working on a stolen password hash. They are average times, half the search space, since an attacker expects to find the password halfway through rather than on the last guess.

Past about 93 bits the tool stops quoting a figure. The honest answer at 100 bits is two trillion years, and the universe has been running for 13.8 billion, so the number has left the range where anyone can weigh it against anything.

The number this tool gives you is a ceiling, not a measurement.

The entropy formula assumes every character was picked at random and independently. That assumption is what the bits are counting. Type “correct-horse-battery-staple” into the box and it reports 164.7 bits, because it sees 28 characters drawn from a 59-symbol pool. Nobody attacking that phrase would guess it character by character. They would guess it word by word, and four words chosen from a list of a few thousand is closer to 45 or 55 bits.

The same gap works against short passwords too. “P@ssw0rd!” scores 59.1 bits here and dies in a real dictionary attack in well under a second, because leetspeak substitution on a common word is the first thing every cracking tool tries.

So read the score as the strength of a randomly generated password of that shape. If you generated it with a password manager, the number is honest. If you thought it up, it is not.

NIST password guidelines (SP 800-63B):

• Minimum 8 characters for user-created passwords
• Minimum 6 characters for system-generated passwords
• Check against breached password databases
• Do not require special characters (length matters more)
• Do not require periodic changes unless breach is suspected

Passphrases outperform complex short passwords. Four words picked at random from a decent word list is roughly 45 to 55 bits, and you will actually remember it. “P@$w0rd1” scores 52.6 bits on this page and is worth a fraction of that in practice, because it is one dictionary word wearing the substitutions every cracking tool tries first. The two numbers look similar. The passwords are not.