How password entropy is calculated
Entropy measures how hard a password is to guess, in bits. The formula is entropy = length × log2(pool size), where the pool size is how many distinct characters could appear in each position. For a 12-character password using all 94 printable ASCII symbols: 12 × log2(94) ≈ 78.66 bits. Each extra bit doubles the number of guesses an attacker needs.
For a closely related job, the random password generator does it in one click.
How to use this calculator
Enter the password length and the character pool size (26 for lowercase, 52 for mixed case, 62 with digits, 94 for all keyboard symbols). The tool returns the entropy in bits and a strength label. To see how data is sized in bits, see the bits to bytes calculator.
The pool size must match how the password was made: one you invented yourself has far less real entropy than the formula suggests, because the maths assumes every character was picked at random. Nothing you enter is uploaded, since the calculation runs in your browser.
Entropy strength reference
Common strength thresholds:
| Entropy | Rating |
|---|---|
| under 28 bits | Very weak |
| 28–35 bits | Weak |
| 36–59 bits | Reasonable |
| 60–127 bits | Strong |
| 128+ bits | Very strong |
Common pool sizes: 26 lowercase, 52 mixed case, 62 alphanumeric, 94 full ASCII. For base conversions, see the binary to decimal calculator.
Aim for 80 bits or more on accounts that matter. A 16-character random password from the full ASCII set gives about 105 bits; four random dictionary words give roughly 52 bits, so use five or six.
Frequently asked questions
- What is the entropy of a 12-character password?
- Using all 94 keyboard symbols it is about 78.66 bits (12 × log2(94)), which rates as Strong.
- What pool size should I use?
- 26 for lowercase only, 52 for mixed case, 62 for letters plus digits, and 94 for the full set of printable ASCII characters.
- How many bits of entropy is secure?
- 60+ bits is generally Strong and 128+ bits is Very strong. Below 28 bits is considered very weak.
- Does length or character variety matter more?
- Both help, but length usually wins: adding characters multiplies entropy faster than expanding the pool, so a long passphrase can beat a short complex one.
- Do I have to type my real password in?
- No, and you should not need to: the calculator only asks for a length and a pool size, never the password itself. Nothing you enter leaves your browser, because the whole calculation runs on your own device.