How long would it take to crack an 8-character password?

If the 8 characters are random lowercase letters, the tool gives 37.60 bits: 4 months at 10,000 guesses a second, 10 seconds at 10 billion and less than a second at 100 trillion. With all four groups, 8 characters give 52.4 bits, and 4 days offline. The rates are assumptions, not measurements. Read the online column as an upper speed: NIST SP 800-63B-4 requires a login service to allow no more than 100 failed attempts in a row on an account, so a real attack against a login form is far slower than 10,000 guesses a second.

Is a longer password better than a complex one?

In this model length counts for more. 16 random lowercase letters give 75.2 bits, close to 12 characters from all four groups (78.7 bits) and far above 8 characters from all four groups (52.4 bits). NIST SP 800-63B-4 sets a minimum of 15 characters for a password used as the only factor.

Why is password123 Very Weak when it has 56.87 bits?

The bits describe a password picked at random from its pool. password123 is on the tool’s list of common passwords, which attackers try first, so the tool rates it Very Weak and says the entropy figure does not describe it. A listed word followed by up to four digits or symbols (password99), a listed word with letters swapped for symbols, a repeated character and a run such as abcdef are treated the same way.

Where does the common-password list come from?

It is a small sample of 165 passwords written by the tool’s author from general knowledge of widely leaked ones. It is not a published list. A password that is not flagged can still be easy to guess: correcthorsebatterystaple is not on it and shows 117.51 bits.

Is it safe to type my password here?

The password stays in the field: the page does not put it in the address bar, save it or show it anywhere else. If you would rather not type a real password, switch to Estimate from settings and enter only the length and the character groups it uses; the figures are the same as for a random password built that way.

Password Entropy Calculator

Estimate password entropy as length × log₂(pool size) and average crack times at three guess rates. Common passwords and patterns are rated Very Weak. How it works

Enter password

The password stays in this field: it is not put in the address bar, saved, or shown anywhere else on the page.

Entropy

Enter a password to see its entropy and crack-time estimates.

About the Password Entropy Calculator

A random 12-character password that uses lowercase, uppercase, digits and symbols has 78.66 bits of entropy (12 × log₂ 94), which the tool rates Strong. At its assumed 10 billion guesses a second, searching half of the 4.8 × 10^23 combinations takes about 754,567 years. The figure holds only for characters picked at random: password and password123 are rated Very Weak because they are on the tool’s small built-in list of common passwords. Estimate from settings gives the same figures for a generator’s length and character groups with no password typed: 16 characters from all four groups give 104.87 bits.

Entropy and offline crack time of random passwords

Length	26 (lowercase only)	62 (letters and digits)	94 (all four groups)
8	37.6 bits, 10 seconds	47.6 bits, 3 hours	52.4 bits, 4 days
10	47.0 bits, 2 hours	59.5 bits, 1 year	65.5 bits, 85 years
12	56.4 bits, 2 months	71.5 bits, 5,115 years	78.7 bits, 754,567 years
14	65.8 bits, 102 years	83.4 bits, 19.7 million years	91.8 bits, 6.7 billion years
16	75.2 bits, 69,141 years	95.3 bits, 75.6 billion years	104.9 bits, 58.9 trillion years
20	94.0 bits, 31.6 billion years	119.1 bits, 1.1 quintillion years	131.1 bits, more than a sextillion years

The column heading is the pool size N. Time is the average case, half of N^L guesses, at the tool’s assumed offline rate of 10 billion guesses a second. The rate is an assumption, not a measurement, and the table holds only for characters chosen at random.

What the tool says about some example passwords

Password	Length	Pool	Bits	Label	Offline crack time
password	8	26	37.60	Very Weak	among the first guesses
password123	11	36	56.87	Very Weak	among the first guesses
qzvkxwpj	8	26	37.60	Weak	10 seconds
Tr0ub4dor&3	11	94	72.10	Strong	8,027 years
xT7#kQ9@vL2&	12	94	78.66	Strong	754,567 years
correcthorsebatterystaple	25	26	117.51	Strong	375.4 quadrillion years

password and password123 are on the built-in list, so the label is Very Weak whatever the bits say. The last password is not on the list and is rated Strong, though it is made of four common words; the model cannot see that.

How to use this tool

Type or paste a password into the field. Show password reveals it.
Read the entropy in bits, the label and the three crack-time estimates: online (10,000 guesses a second), offline (10 billion) and supercomputer (100 trillion).
If a flag appears, the password is on the common list or is a simple pattern, and the entropy figure does not describe it.
Press Show Calculation Details for the length, the pool size, the number of combinations and the formula with your numbers.
To size a generator instead, switch to Estimate from settings, enter a length from 1 to 1,000 (a larger number gets a message), tick the character groups and add any extra characters of a custom pool.

Frequently asked questions

How is password entropy calculated?: E = L × log₂(N) bits, where L is the length in characters and N is the pool of characters the password draws on: 26 for lowercase, 26 for uppercase, 10 for digits and 32 for any other character, added for each group present. For xT7#kQ9@vL2&, L is 12 and N is 94, so E is 78.66 bits.
How long would it take to crack an 8-character password?: If the 8 characters are random lowercase letters, the tool gives 37.60 bits: 4 months at 10,000 guesses a second, 10 seconds at 10 billion and less than a second at 100 trillion. With all four groups, 8 characters give 52.4 bits, and 4 days offline. The rates are assumptions, not measurements. Read the online column as an upper speed: NIST SP 800-63B-4 requires a login service to allow no more than 100 failed attempts in a row on an account, so a real attack against a login form is far slower than 10,000 guesses a second.
Is a longer password better than a complex one?: In this model length counts for more. 16 random lowercase letters give 75.2 bits, close to 12 characters from all four groups (78.7 bits) and far above 8 characters from all four groups (52.4 bits). NIST SP 800-63B-4 sets a minimum of 15 characters for a password used as the only factor.
Why is password123 Very Weak when it has 56.87 bits?: The bits describe a password picked at random from its pool. password123 is on the tool’s list of common passwords, which attackers try first, so the tool rates it Very Weak and says the entropy figure does not describe it. A listed word followed by up to four digits or symbols (password99), a listed word with letters swapped for symbols, a repeated character and a run such as abcdef are treated the same way.
Where does the common-password list come from?: It is a small sample of 165 passwords written by the tool’s author from general knowledge of widely leaked ones. It is not a published list. A password that is not flagged can still be easy to guess: correcthorsebatterystaple is not on it and shows 117.51 bits.
Is it safe to type my password here?: The password stays in the field: the page does not put it in the address bar, save it or show it anywhere else. If you would rather not type a real password, switch to Estimate from settings and enter only the length and the character groups it uses; the figures are the same as for a random password built that way.

How many characters a random password needs

Each random lowercase letter adds 4.70 bits (log₂ 26), and each character drawn from all four groups adds 6.55 bits (log₂ 94). So 16 random lowercase letters give 75.2 bits, close to the 78.7 bits of 12 characters drawn from all four groups, and 17 lowercase letters (79.91 bits) pass them. An 8-digit number such as 48213907 has only 26.58 bits: under a second at the offline rate. Estimate from settings sizes a generator without a typed password: 16 characters from all four groups give 104.87 bits. The figure is not an audit or a compliance check.

Entropy, crack time and the common list

E = L × log₂(N) bits, where L counts characters by code point (an emoji is one) and N is the pool: 26 for lowercase, 26 for uppercase, 10 for digits and 32 for any other character, added for each group present. Combinations are N^L, and the average crack time is half of them divided by a guess rate. The three rates are assumptions, not measurements: 10,000 per second online, 10 billion offline and 100 trillion for a supercomputer.

Labels: Very Weak under 28 bits, Weak under 50, Reasonable under 60, Strong under 128, Very Strong above that, from 128 bits. The Password Generator uses the same scale. 50 bits is about 16 hours offline. Example: xT7#kQ9@vL2& has L = 12 and N = 94, so 78.66 bits, Strong, and 754,567 years at 10 billion guesses a second.

These figures hold only for random characters. A password on the built-in list of 165 common passwords is rated Very Weak, and so is a listed word followed by up to four digits or symbols, a listed word with letters swapped for symbols, a repeated character or block, and a run such as abcdef; each shows 'among the first guesses'. The list is a small sample, not a published one, so an unflagged password can still be easy to guess.

Related Tools

View all tools

Dev

Password Generator

Generate a random password of 8 to 128 characters from uppercase, lowercase, numbers and symbols, and see its entropy in bits. Can skip look-alike characters.

Dev

Chmod Calculator

Type a chmod mode such as 755 or 4755 to see rwxr-xr-x, or paste rwxr-xr-x or tick read, write and execute for owner, group and public to get the octal number.

Dev

Data Storage Converter

Convert bytes, KB, MB, GB, TB and bits, with decimal SI units (1 GB = 1,000 MB) kept apart from binary IEC units (1 GiB = 1,024 MiB).

Dev

AES Encryption

Encrypt and decrypt text with a password using AES-256-GCM, the key derived by PBKDF2-SHA256 at 600,000 iterations. Strength depends on the password.

Dev

Text Encryptor and Decryptor

Encrypt or decrypt text with a password using AES-256-GCM and a PBKDF2-SHA-256 key of 600,000 iterations. The password cannot be recovered if lost.

Dev

PBKDF2 Calculator

Derive a PBKDF2 key in hex or Base64 from a password and salt with HMAC-SHA-1, SHA-256, SHA-384 or SHA-512, and check it against a key you paste.