Password Strength Guide: Entropy & Crack Times
Most password advice — "use 8 characters, add a number" — is outdated and misleading. The real measure of a password's strength is its entropy: how many guesses an attacker must try, on average, to find it. This guide explains entropy and shows why length beats complexity.
What Is Password Entropy?
- characters — size of the character set used
- length — number of characters in the password
Each bit of entropy doubles the search space.
Common character-set sizes: lowercase = 26; + uppercase = 52; + digits = 62; + symbols ≈ 95.
Estimating Crack Time
Divide by 2 because, on average, half the space is tried before a hit.
Example: an 8-character password using all 95 printable symbols has entropy 8 × log₂(95) ≈ 52 bits. At 10 billion guesses/sec (offline GPU attack), that's 251 ÷ 1010 ≈ 2.25 × 105 seconds ≈ 2.6 days. A 12-character version: ~78 bits → ~1013 years.
Length Beats Complexity
Adding one character to a password multiplies the search space by the character-set size. Adding a symbol (going from 62 to 95 chars) only multiplies by ~1.5 per character. So a long password of random words (a "passphrase") is both stronger and easier to remember than a short scrambled one.
Four random common words (e.g. "purple-turtle-window-guitar") ≈ 52 bits of entropy — comparable to a complex 8-char password, but far easier to type and remember.
Real Attacks Aren't Brute-Force
Attackers use dictionaries, leaked-password lists, and pattern substitution (a→@, e→3). So "P@ssw0rd1!" — which looks complex — is actually weak because it's a known pattern. True strength comes from randomness, not from mangling common words.
A strong password is useless if it's leaked in a breach and reused elsewhere. Use a password manager to generate and store a unique random password for every site.
Put It Into Practice
Type or generate a password to see its entropy in bits and an estimated crack time at several attack speeds.
Try the Password Strength Checker
Live entropy, crack-time estimates, and a built-in generator.
🔐 Open Password Checker →