Skip to content
MasterMath

Password Strength Calculator

How long an attacker would take to try every combination of a password, and why making it longer beats making it more complicated.

Average time to crack it

—

Average time to crack it—
Entropy—
Rating—
Possible combinations—
With one more character—
If the attacker had twice the power—

How this was worked out

    The formula

    combinations = alphabet raised to the length

    Where it comes from

    It is pure combinatorics: with an alphabet of 94 characters and 12 positions there are 94 to the power of 12 possible combinations, and on average you hit halfway through. The measure that sums all that up is entropy in bits, the base-two logarithm of the number of combinations: every bit of entropy doubles the attacker’s work. Twelve characters from the whole keyboard give 78.7 bits.

    How to work it out by hand

    1. Count how many different characters could appear
    2. Raise that to the length of the password
    3. Divide by two: on average you hit halfway
    4. Divide by the attacker’s attempts per second

    What is worth knowing

    The practical conclusion is one and it runs against intuition: **length beats complexity**. Every extra character multiplies the time by the whole alphabet, whereas adding odd symbols multiplies it once. Twelve lower-case letters give more entropy than eight characters from the whole keyboard, and are far easier to remember and to type: hence the recommendation to use passphrases. But none of this holds if the password is not random. Swapping letters for numbers — "p4ssw0rd" — adds almost nothing, because attack dictionaries have had those substitutions built in for twenty years. And a password reused on two sites is worth whatever the weaker of the two is worth.

    Frequently asked questions

    How long does it take to crack a 12-character password?

    From the whole keyboard, against an attacker doing ten billion attempts a second, on the order of seven hundred thousand years on average. At eight characters, a few hours.

    What is password entropy?

    The base-two logarithm of the possible combinations. Each bit doubles the attacker’s work; below 60 bits a password is considered weak.

    Longer or more complicated?

    Longer. Every extra character multiplies the time by the whole alphabet; adding odd symbols multiplies it once. Twelve lower-case letters beat eight from the whole keyboard.

    Does swapping letters for numbers help?

    Barely. Attack dictionaries have had those substitutions built in for decades: "p4ssw0rd" falls about as fast as "password".

    Why might my long password still fall?

    Because this sum assumes it is random. If it is in a dictionary or appeared in a breach, it is not attacked by trying combinations: it is tried directly.

    How many characters should it have?

    At least twelve if it is random, and better a passphrase of four or five unrelated words. And different on every site.