Should I add symbols or add length?

Length. Four more lowercase characters adds about nineteen bits where symbols on a short password adds about six. That is why passphrases outperform complexity rules.

Does this apply to a password I chose myself?

No. This assumes randomness. A password with words, dates or keyboard patterns has a fraction of the entropy its length suggests, because attackers search those patterns first.

Technologysecurity

Password Strength and Entropy Calculator

Password entropy and time to crack. Length contributes more than character variety: adding four lowercase letters beats adding symbols to a short password, which is why passphrases work.

Also called: password strength calculator, entropy bits calculator.

Entropy

71.45

71.45 bits from an alphabet of 62 characters. At 1,000,000,000 guesses a second an exhaustive search averages 51117.1 years. Adequate for most purposes. A passphrase of random words often beats a short complex password and is far easier to remember.

Alphabet size

Average time to crack

51117.1 years

Possible combinations

2^71.5

Passphrase entropy

Random characters for the same entropy

Strength

Adequate for most purposes

On passphrases

A passphrase of random words often beats a short complex password and is far easier to remember.

On privacy

This runs in your browser. Nothing you paste is sent anywhere, which matters for anything sensitive.

How this is calculated

Method and background

How this is calculated

Entropy is length times the base-two logarithm of the alphabet size, giving bits. Because length multiplies and alphabet only enters through a logarithm, extending a password is far more effective than adding character classes: going from eight to twelve lowercase characters adds about nineteen bits, where adding symbols to eight characters adds about six. A passphrase of random words from a large list exploits this directly, which is why six random words beat a short string of punctuation.

entropy is length times the log of the alphabet, so length buys more than complexity

L: Length
N: Alphabet size

Worked examples

Each of these is asserted on every build. If a change to the engine ever moved one of these answers, the build would fail before the page could print it.

twelve mixed characters

Password length: 12
Lowercase letters: Yes
Uppercase letters: Yes
Digits: Yes
Symbols: No
Guesses a second an attacker manages: 1,000,000,000
Or, words in a passphrase: 0
Wordlist size: 7,776

Entropy71.45

12 x log2(62)

Open this example

six random words beat it

Password length: 12
Lowercase letters: Yes
Uppercase letters: Yes
Digits: Yes
Symbols: No
Guesses a second an attacker manages: 1,000,000,000
Or, words in a passphrase: 6
Wordlist size: 7,776

Entropy71.45

boundary: 6 x log2(7776), the point of the page

Open this example

Method and limits

What it assumes

A truly random password. Anything chosen by a person has far less entropy than its length suggests.

What it deliberately does not model

Real passwords are not random, and a memorable one is much weaker than this calculation implies.
Attackers use dictionaries and rules, not exhaustive search, so a pattern-following password falls far faster.
Reuse across sites defeats any amount of entropy on one of them.

Formula version 1.0.0 · definition 1.0.0 · United States · Report a problem with this calculator

Frequently asked questions

Should I add symbols or add length?: Length. Four more lowercase characters adds about nineteen bits where symbols on a short password adds about six. That is why passphrases outperform complexity rules.
Does this apply to a password I chose myself?: No. This assumes randomness. A password with words, dates or keyboard patterns has a fraction of the entropy its length suggests, because attackers search those patterns first.