Example 1
- length 12
- charset 95
78.8 bits
What entropy at 12 and 95 characters? 78.8 bits. Shannon, not a cracker.
Password Entropy Calculator
Type a length and a charset. 12 and 95 give 78.8 bits. 8 and 62 give 47.6 bits. 16 and 26 give 75.2 bits. Shannon bits, not a cracker.
This is len × log2(charset) for independent characters. Not a cracker and not HaveIBeenPwned. Hash risk sits on hash collision probability.
Results
Enter data and click Calculate.
How it works
Password Entropy Calculator in this calculator is length times log2 of the charset. 12 characters and 95 give 78.8 bits. 8 and 62 give 47.6 bits. 16 and 26 give 75.2 bits. The calculator does not crack a password and does not query HaveIBeenPwned.
Field pass-len is the length. Select pass-charset in the examples is 95, 62, or 26. Field pass-chars gets the same number. 12 × log2(95) ≈ 78.8. 8 × log2(62) ≈ 47.6. 16 × log2(26) ≈ 75.2.
78.8 bits is not a hashcat measurement. 47.6 bits does not come from rockyou. 75.2 bits on lowercase only does not know a dictionary. You type length and charset. This is not a leak checker.
Hash collisions next door take n and digest bits. JWT token size estimates token characters. Here 12 and 95 stay 78.8 bits, Shannon alone.
Type 12, leave charset 95, then Calculate. The result is 78.8 bits. Charset 62 at 8 gives 47.6 bits. Zero length gives no bits.
12 and 95 give 78.8 bits. 8 and 62 give 47.6 bits. 16 and 26 give 75.2 bits. Another length at 95 changes 78.8 bits.
Formula
bits = length × log2(charset). Shannon for independent characters, not a cracker.
How to use
- Type length 12 and leave charset 95.
- Click Calculate. The result is 78.8 bits.
- 8 and 62 give 47.6 bits. 16 and 26 give 75.2 bits.
- Shannon bits, not a password cracker.
- The next card times a hash collision, not a password.
12 and 95 give 78.8 bits
Bits = length × log2(charset). 12 and 95 give 78.8 bits. Not a cracker.
- Password
- Length times charset. 8 and 62 give 47.6 bits. Not a leak check.
- Entropy
- Shannon from two fields. 12 and 95 leave 78.8 bits.
- Calculator
- The calculator result. 16 and 26 give 75.2 bits. Not hashcat.
Examples
Example 2
- length 8
- charset 62
47.6 bits
What entropy at 8 and 62? 47.6 bits.
Example 3
- length 16
- charset 26
75.2 bits
What entropy at 16 and 26? 75.2 bits.
Related calculators
Common questions
How many bits at 12 and 95?
78.8 bits. 12 × log2(95). Shannon, not a cracker.
What about 8 and 62?
47.6 bits. Alphanumeric charset 62.
What about 16 and 26?
75.2 bits. Lowercase only, a longer entry.
Does the calculator crack a password?
No. No hashcat and no HaveIBeenPwned.
Why select pass-charset?
95, 62, or 26 in the examples. pass-chars gets the same number.
Does a dictionary come off 78.8 bits?
No. The formula assumes independent characters. A list word is weaker.
Does zero length count?
No. Length must be positive.
How is this different from hash collisions?
That card uses n and digest bits. Here 12 and 95 give 78.8 bits.
Does a comma in 12,5 work?
Yes as a number. The examples keep 12, 8, and 16.
Knowledge sources
The calculator counts bits, bytes or throughput from your numbers. Below are SI and bit definitions (NIST).
Page updated in 2026.
What password entropy means
Password entropy is the number of bits describing how much "uncertainty" (randomness) a password carries against a guess-and-check attack. Higher entropy means more possible combinations to search through — it is the standard strength measure used in cryptography and security guidance (e.g. NIST SP 800-63B).
Formula: bits and keyspace
The calculator computes entropy as H = L × log₂(N), where L is the password length and N is the number of possible characters in the set. The full keyspace is N^L — too large a number to display directly, so we show its base-10 logarithm instead (log₁₀(N^L) = L × log₁₀ N).
Character set sizes
| Set | Character count (N) | Bits per character (log₂N) |
|---|---|---|
| Lowercase a-z | 26 | ~4.70 |
| Lowercase + uppercase | 52 | ~5.70 |
| Alphanumeric (a-zA-Z0-9) | 62 | ~5.95 |
| Full ASCII (with special characters) | 95 | ~6.57 |
Entropy vs brute-force time
- Each extra bit of entropy doubles the number of combinations to search — entropy grows far faster than the raw password length.
- Real-world crack time depends heavily on how the password is stored: a fast hash (MD5, unsalted SHA-1) can be checked billions of times per second on a GPU, while a slow hash (bcrypt, scrypt, Argon2) is thousands of times slower to attack.
- Entropy is an upper bound on offline attack difficulty; an online attack (via a login form) is usually far slower thanks to rate limiting and account lockouts.
Human-chosen passwords are weaker than random
This formula assumes each character is chosen uniformly at random. In practice, people pick dictionary words, common substitutions (a→@, o→0), and patterns (a year, a name plus digits) — the real entropy of such a password is much lower than this calculator’s output. That is why a passphrase built from several random words can be practically stronger than a short "random-looking" password.
Examples
- 8 characters, lowercase only (26) → about 37.6 bits — crackable offline in a reasonable time.
- 12 characters, full ASCII (95) → about 78.8 bits — strong with proper password hashing.
- 16 characters, alphanumeric (62) → about 95.3 bits — very strong, comfortable safety margin.