Password Strength Calculator
Password strength isn't really about looking complicated — it's about how large a 'search space' an attacker has to try, which depends mathematically on both length and character variety.
Inputs
Result
Strong (65.7 bits)
Character pool 95 · Length 10
How the password strength calculator works
Character pool size adds up based on which types are used: lowercase (+26), uppercase (+26), digits (+10), symbols (+33).
Entropy (bits) = password length × log₂(pool size) — this represents how many yes/no guesses, roughly, it would take to narrow down the password by brute force.
Strength label: under 40 bits is Weak, 40-60 Fair, 60-80 Strong, above 80 Very strong.
Worked example: 'Sunset-42!' (10 characters)
- Contains lowercase, uppercase, digits and a symbol: pool = 26+26+10+33 = 95.
- Entropy = 10 × log₂(95) ≈ 10 × 6.57 ≈ 65.7 bits.
- 65.7 bits falls in the 60-80 range, so this is rated 'Strong'.
Common mistakes to avoid
Assuming a longer password with less variety beats a shorter one with more variety
Both length and character pool multiply into entropy — a 20-character password using only lowercase letters (pool 26) can actually have lower entropy than a 12-character password mixing all four character types, depending on the exact numbers.
Treating a 'Strong' rating here as proof against every kind of attack
This entropy calculation models resistance to brute-force guessing specifically — it says nothing about whether the password appears in leaked-password databases or follows a predictable pattern, which real attackers check first.
Frequently asked questions
Why does adding a symbol help more than adding another letter sometimes?
It depends on the existing pool — adding a character type not yet present (like the first digit or symbol) expands the pool notably, while adding more characters from a type already used only adds length, not pool size.
What does 'bits of entropy' actually mean intuitively?
Each additional bit roughly doubles the number of guesses needed to brute-force the password — so a jump from 40 to 60 bits represents roughly a million times more possible combinations to search.
Is a computed 'Very strong' rating enough on its own for account security?
It's a good sign against brute-force guessing, but real-world security also depends on not reusing the password elsewhere and it not being an easily guessed pattern or dictionary phrase, which this entropy calculation doesn't detect.
Does password length matter more than character variety?
Generally length has a larger effect for longer passwords, since it's a direct multiplier in the entropy formula, but both matter — a very short password can't reach high entropy no matter how varied its characters are.
Related calculators
Binary Converter
Convert decimal numbers to binary and back.
Internet Speed Calculator
How long a download takes at a given connection speed.
Screen Time Calculator
How much of your life goes to screens.
Hex to RGB Converter
Convert a hex colour into RGB and HSL.
ASCII Converter
Convert text to ASCII character codes.