Calculator Inputs
Estimate secret strength using entropy, search space, and brute-force assumptions.
Example Data Table
| Secret Type | Length | Pool Size | Estimated Bits | Assessment |
|---|---|---|---|---|
| User Password | 12 | 62 | 71.45 | Strong when randomly generated |
| Hex Token | 32 | 16 | 128.00 | Excellent for API use |
| Base64 Secret | 24 | 64 | 144.00 | Very high brute-force resistance |
| Numeric PIN | 6 | 10 | 19.93 | Weak for offline attacks |
Formula Used
The calculator estimates entropy bits with this formula: Bits = Length × log2(Pool Size).
Search space is Pool SizeLength. Average brute-force work is half the full search space, because a correct guess is typically found midway.
Effective guessing rate is: Guesses per Second × Parallel Rigs × Safety Factor. The safety factor lets you model stronger attackers or future hardware improvements.
This is a mathematical estimate, not a guarantee. Real security drops when secrets follow patterns, dictionary words, keyboard paths, reused fragments, or predictable substitutions.
How to Use This Calculator
- Enter a label so you can identify the secret.
- Set the secret length in characters.
- Select character groups or enable a preset pool.
- Optionally add a custom character set.
- Enter the attacker guess rate and parallel rigs.
- Adjust the safety factor for conservative estimates.
- Press Calculate Bit Strength.
- Review entropy, crack time, strength tier, and the graph.
FAQs
1. What does bit strength mean here?
It means estimated entropy in bits. Higher values indicate a larger search space and greater resistance to brute-force guessing when the secret is randomly generated.
2. Is entropy the same as real-world security?
No. Entropy is a theoretical estimate. Real-world strength can be much lower when users choose common words, patterns, reused phrases, or predictable substitutions.
3. Why does length matter so much?
Each additional random character multiplies the search space. Because entropy scales with length, even small increases can dramatically improve brute-force resistance.
4. When should I use the hex preset?
Use it for secrets stored or transmitted as hexadecimal strings, such as hashes, random identifiers, or cryptographic values encoded with sixteen symbols.
5. Why include a safety factor?
It helps model stronger attackers, future hardware, or optimistic assumptions in your input data. Raising it makes the estimate more conservative.
6. Is a long password always strong?
Not always. Length helps, but predictable structure reduces real resistance. Long random passwords or passphrases from unbiased generation are much safer.
7. Can I use this for API tokens?
Yes. It is especially useful for generated tokens, reset links, session secrets, invite codes, and other random strings used in software systems.
8. What is a good entropy target?
For many random application secrets, 64 bits is decent. For long-lived high-value secrets, 80 to 128 bits offers a much safer margin.