Generated password strength
| Attack scenario | Time to crack |
|---|---|
| Online (throttled) | |
| Offline — strong hash | |
| Offline — weak hash (MD5) |
Password entropy measures how unpredictable a password is — the higher the number of bits, the harder it is to guess by brute force. It depends on two things: how many possible characters could appear at each position (the character pool), and how long the password is.
Entropy in bits is log₂(pool size) × length. A password using only lowercase letters (26 characters) draws from a small pool; adding uppercase, digits, and symbols expands it to as much as 94 characters. Doubling the length or significantly expanding the character set both increase entropy, but length tends to have the larger effect — a longer password with a smaller character set often beats a shorter one with a larger set.
The crack time table shows how long it would take an attacker to work through every possible combination at three realistic speeds: a cautious online attack throttled by login rate limits, an offline attack against a strong (properly salted and slow) password hash, and an offline attack against a weak, fast hash like unsalted MD5. A password that would take centuries to crack online can fall in minutes if the database storing it uses a weak hashing algorithm — which is why unique passwords per site and a password manager matter as much as raw complexity.
The raw entropy calculation assumes every character is chosen independently at random. Real passwords rarely are — people reuse known words, keyboard walks, sequential runs, and personal details, all of which real attackers check for before resorting to brute force. That's why this tool also flags common patterns (sequential runs, keyboard walks, known breached passwords, single-character-type passwords) separately from the entropy figure: a password can score well on bits and still be one of the first guesses an attacker tries.
Guidance broadly follows NIST SP 800-63B (Digital Identity Guidelines), which recommends prioritising length and screening against known-compromised passwords over forced complexity rules.