Password strength calculator (entropy)

A password's strength is not how complicated it looks but how many attempts an attacker would need, on average, to hit it. That is measured in bits of entropy:

entropy = length × log₂(character pool size)

Each extra bit doubles the effort required. Note what the formula says: the character pool enters through a logarithm while length enters as a multiplier — so each additional character is worth far more than any special symbol.

How long each password holds out

Assuming an offline attacker able to test 100 billion guesses per second, realistic against a breach with weak hashing:

The limit of the measure

The entropy computed here assumes characters drawn at random. A password your brain chose has far lower real entropy than the formula suggests, because it follows predictable patterns: a dictionary word, a capital first, a number at the end. That is why "P@ssw0rd26" has 10 characters and holds out far less than 10 genuinely random ones.