TheCalculatory
Technology & Fun · Generators Formula verified

Password Generator

Choose a length and which character types to include, and generate a random password — with its entropy in bits and an estimated offline brute-force crack time.

Options
43464
Character types
On-screen number pad
Tap to type into the highlighted field
Generated password
Tr9$mQxV2pLk8!aZ
Strong
Entropy
95.3 bits
Est. crack time
centuries

Step-by-step proofCheck by hand

How entropy and crack time are calculated

Every character position draws uniformly at random from the selected character types, so the total number of possible passwords is the character-set size raised to the length — entropy in bits is just the base-2 logarithm of that count. A brute-force attacker trying the whole keyspace at a fixed guess rate finds the password after, on average, half of it, which is where the crack-time estimate comes from.

The formulas

entropy (bits) = length × log₂(charset size)  ·  crack time = 2^entropy ÷ (2 × guesses/sec)

Worked example

A 12-character password using all 94 printable characters: entropy = 12 × log₂(94) ≈ 78.7 bits — well into "very strong," with a crack time far beyond a human lifetime at 10 billion guesses/second.

Frequently asked questions

What is password entropy?
Entropy measures how unpredictable a randomly generated password is, in bits: it's the length times the base-2 logarithm of the character set size. Each extra bit doubles the number of possible passwords an attacker would have to try, so entropy is a direct measure of how long brute force takes, independent of what the password happens to spell.
Where does the crack-time estimate come from?
It assumes an attacker who has your password's hash and can try guesses offline at a fixed rate — 10 billion guesses per second by default, a commonly cited order-of-magnitude figure for a modern GPU rig — trying the full keyspace and finding the password after, on average, half of it. It's a rough estimate for comparing password strength, not a guarantee about any specific attacker or service.
Why does adding symbols help more than adding length in some cases?
Both add entropy, but they multiply differently: one extra character type enlarges the alphabet every position draws from, while one extra character only adds one more position. For a short password, widening the alphabet (adding symbols or mixed case) often adds more entropy per change than a single extra character — though for any password, more length always helps and is the more reliable lever.
Sources and method
  • NIST Special Publication 800-63B — digital identity guidelines, password entropy and strength.
Last reviewed: 20 Sep 2026 Sources last verified: 20 Sep 2026 Results use the assumptions explained on this page. Report an error How we check calculations

Related calculators

Random Number Calculator Random integers or decimals in a range, with an optional no-duplicates mode. 3 inputsOpen → Unit Converter Length, weight, volume and temperature, all in one converter. 1 inputOpen → Quadratic Calculator Solve ax² + bx + c = 0 for its roots, with the vertex and step-by-step working. 3 inputsOpen →