Calculator Inputs
Example Data Table
| Example | Length | Set Size | Adjusted Entropy | Strength | Average Crack Time |
|---|---|---|---|---|---|
| Balanced 12-char mix | 12 | 95 | 74.24 bits | Strong | 8.56 × 106 years |
| Longer 16-char mix | 16 | 95 | 100.52 bits | Exceptional | 6.97 × 1014 years |
| Lower diversity 10-char | 10 | 36 | 44.46 bits | Fair | 21.16 days |
Formula Used
Active character set size = lowercase pool + uppercase pool + digit pool + symbol pool + custom pool additions.
Search space = SL, where S is active set size and L is password length.
Theoretical entropy = L × log2(S).
Adjusted entropy = theoretical entropy × (0.65 + 0.35 × unique ratio).
Average crack time = (search space ÷ 2) ÷ guess rate.
The adjusted value is intentionally conservative. It lowers the estimate when repeated characters reduce practical diversity, even if the nominal character set remains large.
How to Use This Calculator
Enter the total password length first. Then split that length across lowercase, uppercase, digit, and symbol counts.
Add the estimated number of unique characters. This helps the calculator reduce strength when repetition becomes heavy.
Choose a symbol pool size and optional custom pool additions if your system allows extra characters beyond the common sets.
Select an attack profile or enter a custom guess rate. Then set policy thresholds for minimum length, entropy, and unique characters.
Press Calculate Strength. The result appears above the form, directly below the page header, with summary metrics, policy checks, and attack scenario estimates.
Frequently Asked Questions
1. What does character set strength mean?
It measures how wide the available character pool is and how that pool combines with total length. Wider pools and longer lengths usually produce larger search spaces.
2. Why does repetition lower the adjusted entropy?
Repeated characters create more predictable structures. The calculator applies a uniqueness factor so heavily repeated patterns do not look stronger than they really are.
3. Is this the same as testing a real password?
No. This tool estimates a pattern based on character counts and pools. It is safer than pasting a real password into a webpage.
4. What is a good entropy target?
Many teams aim for at least 60 bits for strong general use, then raise targets for privileged accounts, critical systems, or offline attack exposure.
5. Why are multiple attack scenarios shown?
Attack speed changes with rate limiting, hash type, hardware, and attacker resources. Scenario rows show how the same pattern behaves under different conditions.
6. What does custom pool addition do?
It lets you add extra allowed characters beyond standard lowercase, uppercase, digits, and symbols. This is useful for custom alphabets or extended character policies.
7. Does length matter more than symbols?
Often yes. Adding a few characters of length usually increases search space faster than small composition tweaks. Strong passwords benefit from both length and diversity.
8. Can policy checks replace secure password practices?
No. Policy checks are only a baseline. Use password managers, unique credentials, strong hashing, rate limiting, and multifactor authentication where possible.