Password Strength

Estimating Crack Time From Length and Character Types

A password’s strength is measured by its entropy — how many guesses a brute-force attacker would need in the worst case — which depends on its length and how many different character types it draws from. Enter your password’s composition (never the password itself) to estimate its crack time.

The Formula

$$\vA{\text{Entropy (bits)}} = \text{Length} \times \log_2(\text{Character set size})$$ $$\vB{\text{Average crack time}} = \frac{2^{\vA{\text{Entropy}}}}{2 \times \text{Guesses per second}}$$

Character set sizes: 26 lowercase, 26 uppercase, 10 digits, and 32 common symbols.

Worked Example

An 8-character password using lowercase letters only (26 characters), at 10 billion guesses/second:

1. Entropy: $\vA{8 \times \log_2(26) \approx 37.6 \text{ bits}}$
2. Average crack time: $\vB{\frac{2^{37.6}}{2 \times 10^{10}} \approx 10 \text{ seconds}}$

Key Factors to Consider

• This estimate assumes an OFFLINE brute-force attack against a stolen password hash, which is much faster than an online guessing attempt against a live login form. Most real services rate- limit or lock out repeated failed login attempts, which slows an online attacker dramatically compared to the guesses-per-second figures used here — offline brute-forcing (after a data breach exposes password hashes) is the scenario this kind of estimate is actually most relevant to.
• A common, dictionary-based, or previously-breached password can be cracked far faster than its raw entropy suggests. This calculator assumes a true, uniformly random brute-force search across the full character set — a real attacker typically tries common passwords, dictionary words, and known-breached passwords first, which can crack a “high entropy by the math” password almost instantly if it’s actually a common word with substitutions.
• Guessing speed varies enormously depending on the hashing algorithm protecting the password. A password hashed with a slow, purpose-built algorithm (like bcrypt or Argon2) can take orders of magnitude longer to brute-force than one hashed with a fast, general-purpose algorithm — this is a factor outside a password’s own strength that’s entirely up to how the service storing it implemented security.
• A password’s real-world safety depends on more than crack-time math alone. Reusing a password across multiple accounts, falling for a phishing attempt, or having it captured by malware all bypass this brute-force model entirely — see the Password Generator Calculator’s own Key Factors for the broader picture beyond pure entropy.

Common Mistakes

• Entering an actual real password to “check” it. This calculator deliberately never asks for the real password text, only its length and character types — typing a real password into any online tool, even one that claims not to store it, is an unnecessary risk best avoided entirely.
• Assuming a high crack-time estimate means a password is actually safe to reuse. This calculator measures resistance to brute-force guessing only — a long, high-entropy password reused across multiple sites is still fully exposed the moment any one of those sites suffers a breach, regardless of how many centuries its crack time estimate shows.
• Treating a passphrase made of real dictionary words as equivalent to its calculated entropy. The math here assumes a uniformly random search across the full character set — a password built from recognizable words, names, or patterns is often crackable far faster than its raw length and character variety would suggest, since real attackers try likely guesses first.
• Picking an unrealistic guessing speed and treating the result as precise. Guessing speed varies by orders of magnitude depending on the attacker’s hardware and the hashing algorithm protecting the password — treat the crack-time estimate as a rough order of magnitude, not an exact countdown.

Useful to Know

• Need to actually generate a new password rather than evaluate an existing one? Password Generator creates a random password from a chosen mix of character types using cryptographically secure randomness.