Password Entropy Calculator

How to use this Password Entropy Calculator

What this calculator does

This calculator estimates the theoretical entropy of a password space in bits. It uses the standard combinatorial model E = L × log₂(R), where L is the password length and R is the size of the available character pool. The calculator never asks for the password itself; instead, you enter how many characters come from each category. The result describes resistance to an idealized brute-force search when every allowed password of that length is equally likely. It does not determine whether a specific human-chosen password is safe, whether it appears in a breach list, or whether an account is protected against phishing, credential stuffing, malware, or poor server-side password storage.

When to use it

Use the calculator to compare two password-generation policies, estimate the effect of adding length, see how expanding an allowed symbol set changes the mathematical password space, or document the assumptions behind a randomly generated password. For real account policy, treat the bit value as one analytical input rather than a security certification. Current NIST password guidance emphasizes adequate length, blocklists of common or compromised passwords, support for password managers, and the absence of arbitrary composition rules.

How to calculate

1. The calculator opens with a ready-to-use demonstration: 10 lowercase letters, 2 uppercase letters, 2 digits, and 2 special characters drawn from a 32-symbol pool. The result and a validated example XLSX are available immediately.
2. Replace the demonstration counts with your own category counts. Enter whole numbers only. A blank count is treated as zero. You do not need to type or paste the actual password.
3. If Special characters is greater than zero, set Special characters pool size to the number of distinct special symbols your generation rule can choose from. Use the Custom character pools panel when your rule includes symbols outside the four common categories.
4. Read Password entropy together with Strength, Password length, Character pool size, and the breakdown table. The qualitative strength label is only a convenience band; the numeric entropy is the direct output of the formula.
5. Select Download Excel to export the current validated inputs, result, breakdown, and assumptions to a real XLSX workbook. Select Reset to clear the demonstration and all input data. Reset may disable Download Excel until you enter a complete state with at least one character.

Input guide

Lowercase Latin letters

Optional whole-number count, 0 – 512, representing lowercase a – z characters in the password. Example: 10. Any positive value adds the 26-letter lowercase pool and also increases password length. A common mistake is entering 26 here because 26 is the pool size; this field is the number of lowercase characters actually used.

Uppercase Latin letters

Optional whole-number count, 0 – 512, for uppercase A – Z characters. Example: 2. A positive count adds 26 possible uppercase symbols to the pool. Enter the number of uppercase positions in the password, not 26.

Digits

Optional whole-number count, 0 – 512, for 0 – 9 characters. Example: 2. A positive count adds the 10-digit pool. Do not enter a percentage or a list of digits; enter only how many digit characters the password contains.

Special characters

Optional whole-number count, 0 – 512, for punctuation or other special symbols. Example: 2. A positive count increases length and activates the special-symbol pool. If this field is positive, the Special characters pool size must also be valid.

Special characters pool size

Whole-number pool size from 1 – 10,000 when Special characters is positive; otherwise it is optional. Example: 32 for a common printable U.S.-keyboard symbol set. This is the number of distinct symbols your rule permits, not the number that appear in the password.

Custom 1 characters

Optional whole-number count, 0 – 512, for characters drawn from your first custom set. Example: 3. A positive value increases length and activates Custom 1 pool size. Use it only for a pool that is distinct from the common pools and the other custom pools.

Custom 1 pool size

Whole-number size from 1 – 10,000 when Custom 1 characters is positive. Example: 24. It should equal the number of distinct symbols available to those custom positions; overlapping pools would overstate R.

Custom 2 characters

Optional whole-number count, 0 – 512, for a second distinct custom pool. Example: 2. A positive value increases length and requires Custom 2 pool size.

Custom 2 pool size

Whole-number size from 1 – 10,000 when Custom 2 characters is positive. Example: 12. Enter the available distinct symbols, not a percentage or estimated probability.

Custom 3 characters

Optional whole-number count, 0 – 512, for a third distinct custom pool. Example: 1. A positive value increases length and requires Custom 3 pool size.

Custom 3 pool size

Whole-number size from 1 – 10,000 when Custom 3 characters is positive. Example: 8. As with the other custom pools, treat it as disjoint from all other pools to avoid double-counting.

Output guide

Password entropy is the estimated information content in bits under the uniform model; higher values mean a larger brute-force search space, while zero means the active pool has only one possible symbol or no uncertainty. Strength is a qualitative band derived from the entropy value and should not be treated as a guarantee. Password length is the exact sum of all character counts. Character pool size is the sum of the full pools for every category that has at least one character. In the Character pool breakdown table, Category identifies the pool, Characters used shows its count in the password, Pool contribution shows how many available symbols it adds to R, and Status reports whether that pool is included.

Worked example

The first-open example uses 10 lowercase, 2 uppercase, 2 digits, and 2 special characters. The length is therefore L = 10 + 2 + 2 + 2 = 16. Because all four common pools are active and the special pool is 32 symbols, R = 26 + 26 + 10 + 32 = 94. The calculator evaluates E = 16 × log₂(94) = 104.87 bits, displayed as Very strong in the qualitative band. If you add more characters without shrinking the available pool, entropy rises linearly with length; if you enlarge the pool while holding length constant, entropy also rises, but logarithmically.