Every week, another high-profile account gets broken, and the news almost always comes back to one thing: a password that was too easy to guess. The surprising part is how rarely people understand what makes one password stronger than another. It is not the symbols, and it is not the length alone. What actually matters is a number called entropy, measured in bits, which describes how much guesswork an attacker has to do. This page explains entropy in plain language, shows you how to build a genuinely random password, and gives you a calculator that turns your password plan into two concrete numbers: its entropy and the time it would take to crack.
Why the generator is really a strength calculator
You may have landed here expecting a tool that prints a random string for you. A good password generator can do that, and you should absolutely use one, but the far more useful question is how strong the result is. The calculator on this page answers that question numerically. You pick how long the password will be, which kinds of characters it can use, and how fast you imagine an attacker trying passwords. The tool then computes the size of the entire search space, converts that into bits of entropy, and expresses the worst-case cracking time in seconds and years. Those three numbers tell you more about password security than any amount of marketing copy.
What entropy actually means
Entropy is the measure of uncertainty or surprise in a system, borrowed from information theory. For a password, entropy counts the number of guesses an attacker who knows your rules would, on average, have to try. It is expressed in bits because each bit doubles the work. A password with 10 bits of entropy has about a thousand possible values; 20 bits has about a million; 40 bits has about a trillion. Every extra bit makes the password twice as hard to brute-force, which is why the difference between 40 and 60 bits is not a factor of one and a half, but a factor of a million.
Two factors control a password's entropy: the size of the character set and the length. If your password can draw from lowercase letters only, the set size is 26. Add uppercase and you get 52, throw in digits for 62, and include symbols for roughly 94. The formula this calculator uses adds 26 for lowercase, 26 for uppercase, 10 for digits, and 32 for a common set of symbols. Each character you add multiplies the search space by the set size, so the relationship between length and security is exponential, not linear. This is why a 16-character password from a small alphabet can beat an 8-character one from a huge alphabet.
The two questions the calculator answers
The first number produced is entropy in bits, computed as the password length multiplied by the logarithm, base two, of the character set size. This collapses the whole search space into a single intuitive figure. The strength gauge below the results uses standard rough benchmarks: under 28 bits is very weak, 28 to 50 is weak, 50 to 75 is fair, 75 to 110 is strong, and beyond 110 is very strong. Modern security guidance generally recommends aiming for at least 60 to 80 bits for ordinary accounts and more for anything sensitive.
The second pair of numbers translate that entropy into time. Given a chosen guessing speed, the calculator divides the total number of possible passwords by the number tried per second. An online attacker limited by login rate limits might manage only a thousand guesses per second, while an offline attacker with your stolen password hash and a fast GPU cluster can try a billion per second, and a large coordinated botnet can reach a hundred billion. The default of one billion guesses per second sits squarely in the middle of realistic modern threats, so the times you see are not scare stories, but neither are they the worst case imaginable.
How to build a strong password
Pick a length first, because it dominates everything else. A good starting point is 16 characters, with 12 as an absolute floor for anything you care about and 20 for accounts guarding money or identity. Next, choose your character set. Enabling lowercase, uppercase, and digits costs nothing and roughly doubles the pool twice; symbols add less relative value now that 62-character pools are common, but they still help. The calculator's toggles let you experiment with each combination and watch the entropy move, which is the fastest way to develop intuition about what actually matters.
Then let randomness do the work. The single most damaging mistake in password creation is using patterns a human can predict: a word, a date, a keyboard sequence, or a common substitution like password1. Every one of those rules shrinks the true search space to a tiny fraction of what the raw length suggests, no matter how many symbols you sprinkle in. The entropy figure the calculator shows assumes each position is chosen uniformly at random, which is exactly what a real password manager does. If you generate passwords by hand, you are almost certainly overestimating your own security.
What the attacker model really means
The guessing speed you select is a statement about who might be attacking you and what resources they can deploy. An online brute-force attack has to send each guess to a server, which usually imposes delays and lockouts, so it crawls at thousands of guesses per second. An offline attack is different: if someone has stolen a database of password hashes, they can test guesses locally against the hash at enormous speed, which is why the millions and billions-per-second options exist. The large botnet setting models an attacker who has hijacked tens of thousands of computers and pointed them all at one hash.
Notice that the worst-case times in the tool assume the attacker must exhaust the entire search space before finding your password. In practice, an attacker who guesses randomly finds the answer on average halfway through, so the realistic expected time is roughly half of what you see. Either way, the conclusion is the same: above 70 or 80 bits of entropy, even a fast offline attacker is facing work measured in centuries, at which point password strength stops being the weak link and the conversation shifts to protecting the hash itself.
Why length beats complexity
There is a classic myth that a password stuffed with symbols is automatically strong. The math says otherwise. Consider two approaches. An eight-character password drawn from all 94 symbols has 94 to the eighth possible values, about 6 quadrillion, roughly 52 bits of entropy. A fourteen-character password using only lowercase letters has 26 to the fourteenth, which is roughly 66 bits of entropy and hundreds of times larger. Complexity that forces you into shorter, memorable, predictable patterns is actively harmful, because the length you can actually remember is what protects you.
The calculator makes this concrete: keep length fixed and watch how much the four toggles add, then keep the toggles fixed and watch how much each added character multiplies the time-to-crack. Length consistently wins. This is also the reason the passphrase approach works so well: four or five random words joined together are long, easy to type, and if chosen truly randomly carry surprisingly high entropy. Whatever style you prefer, the rule is the same as always: make it long, make it random, and make it unique to each site.
Putting the numbers to work
Use this calculator to audit passwords you already use. Be honest about how you created them: a birthday plus a pet's name is not random, and the entropy number is a fiction for it no matter what the length slider says. For genuinely random passwords, the tool lets you tune the trade-off between length and cracking time until you find a configuration you can actually manage. Then make sure each account gets its own password, because the one thing entropy cannot protect you from is reusing a password that leaked somewhere else.
Finally, understand what the numbers are not. The time-to-crack figure assumes pure brute-force over the full space, which is the strongest possible defense and therefore the slowest possible attack. Real attackers cut corners using dictionaries, common passwords, and leaked lists, which is why a unique, random, 16-character password matters more than any single clever character substitution. The entropy and cracking-time numbers give you an honest, quantitative picture of how your password would fare against the dumbest possible attacker: one who simply tries everything.
The bottom line
Password security is a math problem with a clear answer. Build the longest random password you can reasonably use, draw it from the broadest character set available, and let a real random source make the choices. The calculator above tells you, in bits and in years, exactly how much protection that buys you against an attacker who has all the time in the world. Start with the default of 12 characters, watch the entropy climb as you add length and character types, and keep going until the gauge sits comfortably in the strong zone. That is the entire secret, and it is a secret anyone can now verify for themselves.
Disclaimer
Results are provided as estimates for informational purposes only and may be inaccurate. Always verify outcomes with a qualified professional before making financial or personal decisions based on these calculations.