Password Entropy Calculator

Background.

This calculator answers one narrow question precisely: if a machine picked every character or word of a secret uniformly at random from a stated alphabet, how many bits of entropy does that secret carry, and how many distinct secrets could the generator have produced? It reports the entropy in bits, the bits contributed by each symbol, and the full key space split into a mantissa and a power of ten so that even a 10^6144 key space stays exact.

The arithmetic is short and worth understanding rather than trusting. NIST defines min-entropy as −log₂(max pᵢ) over a discrete distribution. When a generator draws L symbols independently and uniformly from a pool of C symbols, every one of the C^L possible outcomes is equally likely, so the largest probability is 1 ÷ C^L and the min-entropy is log₂(C^L), which is L × log₂(C). Under a uniform distribution min-entropy and Shannon entropy are the same number, which is precisely why that expression stops being valid the moment the distribution stops being uniform.

That caveat is not a footnote, it is the whole boundary of this page. Entropy measures a generator, not a string. Two passwords can look equally scrambled and have wildly different guessing difficulty, because the number that matters is how the secret was produced, not how it reads. NIST SP 800-63B-4 makes the point in its own appendix on password strength: the effective strength of user-chosen passwords has often been characterised using entropy, but estimating entropy for a human's choice is a different and much harder problem, and the guideline therefore moves to an approach based primarily on length. This calculator will happily accept the length and alphabet of a password you invented and hand you a number — and that number will be an overestimate, quite possibly by a factor of a trillion, because you did not choose uniformly. Nothing on this page is a verdict that a specific password is safe, and the result text says so every time it renders.

The alphabets are not rounded-off folklore. RFC 20, the standard that defines US-ASCII, places the graphic characters at code points 0x20 to 0x7E inclusive and lists SPACE inside that set, which gives 95 printable characters, or 94 once you drop the space bar — the alphabet a US keyboard produces and the pool most password generators default to. RFC 4648 defines the 64-character base64 alphabet. The passphrase options come from the Electronic Frontier Foundation's published wordlists: the long list holds 7,776 words, which is 6⁵ and therefore five dice rolls per word, and the two short lists hold 1,296 words each, which is 6⁴. EFF states 12.9 bits per word for the long list and 10.3 for the short ones, and this calculator reproduces both figures exactly from the list sizes — a useful confirmation that the constants are right rather than merely plausible.

The second mode runs the calculation backwards. Give it a bit target and it returns the shortest secret that reaches or exceeds that target, computed as the ceiling of the target divided by the bits per symbol, along with the entropy actually achieved rather than the entropy requested. Twenty printable-ASCII characters do not have 128 bits of entropy; they have 131.09, and the difference matters when you are writing a policy that has to survive an audit. That mode is also the fastest way to see how badly a small alphabet punishes you: 128 bits takes 20 printable-ASCII characters, 32 hexadecimal characters, 39 decimal digits, or 10 words from the EFF long list.

Below the widget you will find the derivation from NIST's own definition of min-entropy, a worked example computing 94¹⁶ exactly by repeated squaring, an explanation of why length beats character-class rules, and an honest account of the several ways an entropy figure can be wrong in the real world — reused wordlists, seeded generators, capped password fields, and the simple fact that most people do not use a generator at all.

What is password entropy calculator?

Password entropy is a measure of how much work an attacker must do to guess a secret by exhaustive search, expressed in bits. One bit doubles the work. A secret with 60 bits of entropy sits somewhere in a space of 2⁶⁰ ≈ 1.15 × 10¹⁸ equally likely possibilities; adding one bit makes it 2⁶¹. The figure is a property of the process that produced the secret, not of the characters in it. If a generator drew every symbol independently and uniformly from an alphabet of C symbols and produced L of them, the entropy is exactly L × log₂(C) bits and the key space is exactly C^L. NIST's own definition, in the CSRC glossary entry for min-entropy, is −log₂ of the largest probability in the distribution, which for a uniform draw over C^L outcomes is log₂(C^L). Entropy and key space are the same statement written on two scales: key space is the raw count of possibilities, entropy is its base-2 logarithm. Bits are the more useful unit because they are additive — a 12-character password from a 94-character pool has 78.7 bits, and appending four more characters adds 4 × 6.55 = 26.2 more. What entropy is not is a score for a password a human chose. Human choice is not uniform: people pick real words, dates, keyboard walks, and predictable substitutions, so the effective distribution is enormously concentrated and the true guessing difficulty is far below L × log₂(C). That is why NIST SP 800-63B-4 abandoned entropy as the basis for password policy in favour of a length requirement backed by blocklists of known-compromised passwords.

How to use this calculator.

1. 01Choose whether you are solving for entropy (you know the length) or for length (you know the bit target you need to hit).
2. 02Pick the alphabet the generator was actually configured with. If your password manager was set to letters and digits only, choose 62 — not 94, and not 95. Selecting a larger pool than the generator could reach inflates the answer, and nothing in the arithmetic can detect that.
3. 03For a passphrase, choose one of the EFF wordlists and enter the number of WORDS, not the number of letters. Six words from the 7,776-word list is 6, not 34.
4. 04If your generator uses an alphabet that is not listed — a 32-character Base32 set, a 5,000-word custom wordlist, a 58-character Base58 set — choose Custom and enter the number of distinct symbols.
5. 05In entropy mode, enter the length and read the bits. In length mode, enter the bit target and read the length the calculator returns, plus the entropy that length actually achieves (which will be at or slightly above your target, never below it).
6. 06Read the note underneath the result. It places the figure against NIST's published security-strength set and restates the one condition under which the whole calculation is valid: the secret was generated uniformly at random. If you typed in the shape of a password you invented, treat the number as an upper bound you will never reach.

The formula.

Start from NIST's definition rather than from the formula. The CSRC glossary defines min-entropy as −log₂(max pᵢ) for a discrete distribution p₁ … p_k: the largest value m such that every observation of the variable yields at least m bits of information. It is a worst-case measure, which is what you want when reasoning about an attacker who guesses the most likely candidate first.

Now apply it. A generator that draws L symbols independently and uniformly from a pool of C symbols can produce C^L distinct outputs, and by construction each is equally likely, so every probability in the distribution is 1 ÷ C^L and the largest of them is also 1 ÷ C^L. Substituting: H∞ = −log₂(1 ÷ C^L) = log₂(C^L) = L × log₂(C). Because the distribution is uniform, Shannon entropy gives the identical answer; the two measures only diverge once some outcomes are more likely than others, which is exactly the situation a human-chosen password creates.

The key space K = C^L is the same quantity before the logarithm. This calculator computes it in arbitrary precision and reports it as a mantissa and a power of ten, because the numbers get large fast: 94¹⁶ is a 32-digit integer, and the maximum this page will model, a 1,024-symbol secret from a million-symbol alphabet, is 10^6144 — a value no IEEE 754 double can hold, which is why the raw count is never returned as a single number.

Two structural consequences fall straight out of the formula. First, entropy is linear in length and only logarithmic in alphabet size, so length is a far more efficient lever: going from 26 to 52 characters buys one extra bit per symbol, while adding one more symbol buys 4.7. Second, entropy is additive across independent draws, which is what makes passphrases work. Each word from the EFF long list contributes log₂(7776) = 12.9248 bits, so six words give 77.55 bits regardless of how many letters they happen to spell.

The inverse mode inverts the same expression. Solving L × log₂(C) ≥ B for the smallest whole L gives L = ⌈B ÷ log₂(C)⌉, and the calculator reports the entropy that L actually delivers rather than echoing B back, because the two are equal only when log₂(C) divides B exactly — as it does for hexadecimal, where log₂(16) = 4 and 128 bits lands on precisely 32 characters.

One precision note. Bits per symbol is computed as ln(C) ÷ ln(2) in arbitrary-precision decimal and rounded once at the end, so log₂(7776) returns 12.9248125036 rather than a floating-point approximation of it. The key space is computed as an exact integer power wherever the integer has fewer digits than the working precision — 94¹⁶ comes back as 37,157,429,083,410,091,685,945,089,785,856, digit for digit.

A worked example.

Frequently asked questions.

References& sources.

1. [1]NIST, Computer Security Resource Center Glossary — 'min-entropy'. Definition used to derive this page's formula: min-entropy is −log₂(max pᵢ) over a discrete distribution p₁ … p_k, 'the largest value m having the property that each observation of X provides at least m bits of information'. Sourced by NIST to SP 800-90A Rev. 1, SP 800-90B, SP 800-133 Rev. 2 and NIST IR 8427. For a uniform draw over C^L outcomes this yields L × log₂(C).
2. [2]NIST SP 800-63B-4, Digital Identity Guidelines, Appendix A 'Strength of Passwords'. Source of this page's scope limit: entropy has often been used to characterise the effective strength of user-chosen passwords, but estimating it for a human's choice is problematic, so the guideline presents 'a different and somewhat more straightforward approach based primarily on password length'.
3. [3]NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, §3.1.1.1–3.1.1.2. Source of the length and composition rules quoted on this page: passwords used as a single factor SHALL be a minimum of 15 characters; passwords inside multi-factor authentication SHALL be a minimum of eight; verifiers SHOULD permit a maximum length of at least 64 characters; 'Other composition requirements for passwords SHALL NOT be imposed'.
4. [4]NIST, Computer Security Resource Center Glossary — 'security strength'. Source of the bands used in the result note: security strength is 'a number associated with the amount of work (i.e., the number of operations) that is required to break a cryptographic algorithm', measured in bits, commonly {80, 112, 128, 192, 256}, with roughly 2^S operations required at strength S and 80 bits recorded as no longer sufficiently secure.
5. [5]Electronic Frontier Foundation (2016). 'Deep Dive: EFF's New Wordlists for Random Passphrases'. Source of the passphrase alphabet sizes: the long list is '7,776 words (6⁵)' at '12.9 bits' per word, and the two short lists are '1,296 words (6⁴)' at '10.3 bits/word'. Both published bit figures are reproduced exactly by this calculator from the list sizes alone.
6. [6]IETF RFC 20 (Internet Standard 80), 'ASCII format for Network Interchange'. Source of the printable-character counts: the graphic characters occupy code points 0x20 through 0x7E inclusive, with '2/0 SP Space (Normally Non-Printing)' listed inside the graphic set — 95 printable characters in total, or 94 excluding SPACE.
7. [7]IETF RFC 4648, 'The Base16, Base32, and Base64 Data Encodings', §4. Source of the 64-symbol base64 alphabet offered as a pool option.