Advanced options
Crack time assumes an offline attacker testing 10 billion guesses per second against a stolen password database. Entropy maths assumes a random password: real human passwords (words, dates, patterns) fall far faster to dictionary attacks, which is why length plus randomness beats complexity rules. Never type a real password into any website tool, including this one: it works on length and character set only.
What The Password Strength Calculator Works Out
- Entropy: length times the base-2 logarithm of the character set, in bits. 12 random characters from letters and numbers carries about 71 bits; 8 characters from the same set manages 48 bits and falls to a serious offline attacker in hours. Under 40 bits is weak, 60 to 80 strong and over 80 very strong, provided the password is genuinely random.
- Possible combinations: the character set raised to the power of the length, shown as a power of ten. Each extra character multiplies the search space by the whole alphabet, while forcing a symbol into a short password adds a couple of bits and a memorability tax, which is why length beats complexity.
- Average crack time: half the combinations divided by 10 billion guesses a second, the rate of an attacker with a stolen hash database and GPUs, which is exactly what leaks provide. Humans do not produce randomness: names, dates, keyboard walks and Password1! live in the dictionaries crackers try first, so a "complex" human password polls far below its theoretical bits.
- Attack scenario (advanced): change the guess rate. Online guessing against a live login is throttled by lockouts and rate limits to perhaps 10 to 1,000 attempts a second, so even modest passwords survive it; slow hashes such as bcrypt cut an offline attacker to around 100,000 a second, while a large cluster against fast MD5 or SHA-1 hashes can manage a trillion.
- Custom character set size (advanced): any alphabet size, for example 36 for a PIN-style code of lowercase letters and digits, 16 for hexadecimal or 64 for base64.
- Worst case (advanced): the time to try every combination, twice the average, which is the guarantee rather than the expectation.
- Length needed for your target (advanced): the reverse calculation: how many characters from this set reach a chosen entropy. 80 bits needs 14 letters-and-numbers characters or 13 with symbols; a password manager generating 16 or more ends the arithmetic conversation entirely.
- Random-word passphrase (advanced): entropy of a passphrase of so many words drawn at random from a list of the chosen size. This is the maths behind NCSC's three random words guidance: three words from everyday vocabulary give roughly 43 bits and four Diceware words 52 bits, in a form people actually remember and type.
- Words to match this password (advanced): how many random words from the chosen list would equal the password's entropy, a direct comparison between the two approaches. Unique passwords per site, a password manager and two-factor authentication matter more than any of these numbers.
- Length table (advanced): entropy, crack time and rating for lengths from 8 to 24 characters at your character set and attack rate.
Source and further reading: NCSC: three random words.