Wondering how long a stranger would need to break into your login? A crack time calculator turns a password into an estimated time to crack by counting how many guesses an attacker must make, then dividing by how fast they can guess. Enter the length and character set, pick an attack speed, and you get the entropy in bits plus a plain-language rating instantly, so you can protect your accounts before anyone else tests them.
How a Crack Time Calculator Estimates the Time to Crack a Password
Every password lives inside a search space: the full set of strings an attacker could try. A brute force attack walks through that space one candidate at a time, and the time to crack password guesses is simply the size of the space divided by the guessing speed. Because the right answer is equally likely to sit anywhere in the list, the expected wait is half the full search, which is why the calculator reports an average rather than a worst case. A quick pass through the password pattern analyzer catches issues before they become real problems.
Entropy in bits and the number of guesses
Entropy in bits compresses that huge search space into one small number. Each bit doubles the number of guesses, so 40 bits means about a trillion combinations and 70 bits means about a sextillion. The bits of entropy for a randomly chosen password come from this formula, where L is the length and N the size of the pool of possible characters:
$$H = L \times \log_2(N)$$
Converting bits back into the number of guesses and then into seconds gives the figure you actually read on screen:
$$T = \frac{N^{L}}{2 \times R}$$
Here R is the attacker's rate in guesses per second and T is the average time to crack your password. The log2 term converts the pool size into bits per character, and anything the tool prints, whether seconds or billion years, is this one division expressed in friendlier units.
Why the answer is only an estimate
The result is an estimated time, not a promise. It assumes every character was picked at random, that the attacker knows the length and character set, and that the guessing speed stays constant. Real attackers have shortcuts that make a human-chosen password fall faster than the math suggests, which the section on guess resistance below explains.
Password Strength Checker Inputs: Length, Character Set and Attack Speed
A good password strength checker needs only three inputs (whether you call it a password strength calculator or a plain password checker), and each one moves the result by a different amount. Understanding them lets you read any password strength meter with more confidence than a colored bar alone allows.
Password length
Password length is the exponent in the formula, so it is the most powerful lever you have. Every extra character multiplies the work by the pool size, which means the time grows exponentially rather than in a straight line. Going from 8 to 12 characters does not make a password 50 percent harder to crack; it makes it millions of times harder.
Character set and pool size
The character set decides the base of the exponent. The calculator counts which character types appear and adds up the matching pool:
- Lowercase letters add 26 possible characters.
- Uppercase letters add another 26.
- Numbers add 10.
- Symbols and other special characters bring the pool to 95 printable characters in total.
Mixing lowercase, uppercase and digits gives a pool of 62, and that is the charset used in the worked example below. Widening the pool helps, but each extra character types group adds far less than another character of length does.
Attack speed
The third input is the guessing speed, and it depends on where the attack happens rather than on your password. A throttled login form allows perhaps 100 guesses per second, a slow hash on a stolen file allows around 10,000 per second, and a rig of graphics cards working on a fast hash can reach 100 billion per second. Pick the rate that matches your threat and the calculator divides the guess count by it. The next sections show how wide that gap is.
Worked Example: Time to Crack Password Calculator Results at Three Speeds
Take a 12-character password made of lowercase letters, uppercase letters and digits, chosen at random. The pool size is 62, so the entropy is: The character pool size calculator works out the exact figure live as you type, with the formula shown alongside the result.
$$H = 12 \times \log_2(62) \approx 71.45\ \text{bits}$$
That is 6212, or about 3.23 × 1021 combinations, so an attacker needs about 1.61 × 1021 guesses on average. The table shows what that means at each attack speed.
| Attack scenario | Guesses per second | Average time to crack |
|---|---|---|
| Online attack through a login form | 100 | about 511 billion years |
| Offline attack on a slow hash | 10,000 | about 5.11 billion years |
| Offline attack on a fast hash with GPUs | 100 billion | about 511 years |
What-if: change the length
The most useful habit is to rerun the numbers with one input changed. Holding the pool at 62 and the speed at 100 billion guesses per second, the entropy scale and results move like this:
- 8 characters: about 47.63 bits, cracked in roughly 18 minutes.
- 10 characters: about 59.54 bits, cracked in roughly 49 days.
- 12 characters: about 71.45 bits, cracked in roughly 511 years.
- 14 characters: about 83.36 bits, which takes about 1.96 million years.
Two characters at a time, the answer climbs from minutes to hours-scale days, then to years and finally to centuries and beyond. A 16-character password in the same pool reaches roughly 7.55 billion years.
Password Strength Test Results: From Very Weak to Very Strong
A raw time such as "511 years" is hard to judge, so a password strength test usually adds a verdict. The bands below use entropy as the yardstick, and they pair each band with what it typically survives.
| Rating | Entropy | Typical outcome |
|---|---|---|
| Very weak | under 36 bits | Falls in seconds to minutes |
| Weak | 36 to 59 bits | Falls in hours to a few months |
| Good | 60 to 79 bits | Holds for years against slow attacks |
| Strong | 80 to 99 bits | Survives even a heavily funded attacker for a very long time |
| Very strong | 100 bits or more | Beyond any realistic brute force attack |
Those labels are shorthand. Use the password strength table to pick a target before you create a login, then use the password strength rating as a quick sanity check on whatever you end up with. The 12-character example above lands in the "good" band against slow attacks, which is why 14 or more characters is a sensible default for anything important.
Online Attack vs Offline Attack: Why Hashing Speed Changes Everything
The same password can be safe in one situation and hopeless in another, because the attack type sets the guessing speed.
Online attack
In an online attack the attacker types guesses into a real login page. Rate limiting and lockouts cap the speed at a handful of guesses per second, so even a modest password can last a very long time here.
Offline attack
An offline attack begins after a breach. Once an attacker holds a stolen password database, nothing throttles them, and the only limit is how expensive each guess is. That cost depends on the hash the site used when hashing your password. A slow function such as bcrypt forces the attacker to spend real computing time per guess, while a fast one such as MD5 or SHA-256 lets a computer with a few GPU cards and a cracking tool make billions of attempts per second. If a site stored the password database in plaintext, no strength rating helps at all.
This is why the offline fast-hash row of a calculator is the one to watch when you care about a data breach at a service you use.
Checking an Encrypted Backup Password with a Password Strength Checker
You are an independent bookkeeper about to encrypt a year of client ledgers before copying them to an external drive. The drive can be lost, and anyone who finds it can copy the file and guess at it offline with no lockout, so the password is the only barrier. Your first idea is ledger2024x-style: 11 characters, lowercase letters and digits only.
You enter length 11, a character set of lowercase plus digits (a pool of 36), and the fastest attack speed, 100 billion guesses per second. The tool works through the same arithmetic as before:
$$H = 11 \times \log_2(36) \approx 56.87\ \text{bits}$$
That is 1.32 × 1017 combinations, and the average time to crack comes back as about 7.6 days. The rating reads weak, because 56.87 bits sits inside the 36 to 59 bit band, and 7.6 days is a window a determined attacker will happily wait out. It also falls short of the NIST minimum of 15 characters for a password used on its own as a single factor.
Rather than guess, you change one input at a time and rerun:
- 13 characters: 67.21 bits, about 27 years, rated good.
- 16 characters: 82.72 bits, about 1.26 million years, rated strong.
Sixteen characters clears the 15-character NIST floor and moves the result into the strong band, so that is the length you commit to. The next step is to stop typing it by hand: you generate a random 16-character string with the password generator in your password manager, save it there, and store a printed copy of the recovery key in the office safe. A result you can act on beats a score you merely admire.
Password Entropy Calculator Limits: Guess Resistance and Human Patterns
A password entropy calculator is exact for a random string and badly optimistic for one a person invented. The formula assumes every character was drawn independently from the whole pool, but people rarely do that.
Guess resistance beats raw entropy
Guess resistance asks a better question: what is the cheapest way an attacker could reach this particular password? Cracking tools do not start with random strings. They try a dictionary of common passwords, then words, names and dates, then every common trick applied on top. Libraries such as zxcvbn model those shortcuts to give a more honest score than a character count.
- Substitutions and leetspeak, such as swapping an "a" for "@", are tried almost immediately.
- Keyboard walks like "qwerty" and sequences like "12345" sit near the top of every list.
- Repeats and trailing years add almost nothing to the search.
- A blocklist of breached credentials rules out any password that has already leaked.
Spotting any one pattern collapses the guess count, which is why a password built from "password" plus a symbol and the current year can score 60 bits on paper and fall in a few hundred guesses in practice.
Why complexity rules mislead
Complexity rules and composition rules demand a mix of character classes, but they reward the wrong thing. A "one capital, one digit" policy accepts a short, predictable string and blocks a long, easy-to-remember sentence. Current NIST guidance moved the same way, favoring length and a breach check over forced character mixes, and a sound password policy follows suit. In the calculator the same lesson shows up in the numbers: the pool-size input rewards character mixing a little, but the result depends far more on length, so a short password that satisfies every rule still returns a poor result.
Passphrase vs Complex Password: Length Beats Variety
A passphrase built from several unrelated words is the easiest way to get both length and randomness. A 7,776-word list such as Diceware gives about 12.9 bits per word, so the totals build quickly. Enter a pool of 7,776 and a length of 6 and the calculator reports about 77.5 bits, which at 100 billion guesses per second means roughly 35,000 years:
- Four words: about 51.7 bits.
- Five words: about 64.6 bits.
- Six words: about 77.5 bits, comparable to a 12-character fully mixed password.
The catch is that the words must be chosen by a dice roll or a generator, not by you. A quote or a familiar sentence is predictable, and predictable is the opposite of unpredictable. A truly random password or passphrase is also easier to remember than a jumble of symbols, because your memory handles words better than strings.
Password Strength Tester Safety: Your Password Stays in the Browser
Typing a real password into any website deserves caution, so check how a password strength tester handles it. A trustworthy tool runs client-side, which means the scoring happens in your browser and the text is never sent to a server and never stored. You can confirm it by loading the page, disconnecting from the internet and trying it again.
Good privacy and cybersecurity practice goes one step further, because an account that gets hacked through a careless test costs far more than the test is worth: test the shape of a password, not the password itself, if you are not sure about the site. The security of an account is worth more than a precise number.
How to Raise Your Password Strength
A high score means little if the password is used everywhere. These best practices convert a good number into real protection against a hacker. Rerun the calculator after each change to watch the result move.
- Make it long. Aim for at least 14 characters, and more for anything tied to email or a bank account.
- Make it random. Skip personal information such as birthdays and pet names.
- Use unique passwords. Reuse is the real risk, and a strong result says nothing about it, because a leaked copy needs no guessing at all: one compromised site exposes every login that shares the same credentials.
- Add a second factor. MFA adds a layer of authentication that the estimate ignores but a stolen password cannot bypass.
- Let a tool do the work. A secure password manager and a password generator create and store strong secrets so you never type them from memory.
Treat the result as a floor
Whether you use it to evaluate a new password or to teach a team why a "one capital, one digit" rule fails, the result is a floor rather than a guarantee. It does not replace unique logins, encryption at rest or a second factor, but it is a fast, free way to see why length matters and to keep your online accounts safe and secure.
Frequently Asked Questions
- Is it safe to enter my real password into this tool?
- Yes. This calculator runs entirely in your browser — your password is never transmitted to any server or stored anywhere. The calculation is done locally using JavaScript on your device. That said, as a best practice, avoid entering passwords for active accounts into any online tool.
- How is the crack time calculated?
- The calculator estimates the total number of possible password combinations based on your password's length and the variety of characters used (lowercase, uppercase, numbers, symbols). It then divides that number by the assumed attack speed (guesses per second) to estimate how long a brute-force attack would take.
- What is password entropy and why does it matter?
- Entropy is a measure of unpredictability, expressed in bits. The higher the entropy, the harder the password is to crack. It's calculated as log2(charset_size ^ password_length). A password with 60+ bits of entropy is generally considered strong against most attacks.
- What makes a strong password?
- A strong password is long (12+ characters), uses a mix of uppercase and lowercase letters, numbers, and symbols, and avoids common words or predictable patterns. Passphrases — strings of random words — can also be very strong due to their length. Avoid using personal information like birthdays or names.
- What is the difference between an online and offline attack?
- An online attack targets a live login system, which typically limits attempts to a few per second due to rate limiting. An offline attack occurs when a hacker has stolen a database of hashed passwords and can test billions of guesses per second on their own hardware. Offline attacks are far more dangerous.
- Why does password strength matter?
- Weak passwords are one of the most common causes of account breaches. Automated tools can crack simple passwords in seconds. A strong, unique password for every account dramatically reduces your risk of being hacked, especially if a site's password database is ever compromised.
- What are the most common password mistakes?
- The most common mistakes include using short passwords, using dictionary words or names, substituting letters with similar-looking numbers (like 'p4ssw0rd'), reusing the same password across multiple sites, and using predictable patterns like 'Password123!'. All of these are easily exploited by modern cracking tools.
- What is a passphrase and is it more secure?
- A passphrase is a sequence of random words, such as 'correct-horse-battery-staple'. Because passphrases are long, they have high entropy and are very resistant to brute-force attacks. They're also easier to remember than complex random strings, making them an excellent choice for master passwords.