Entropy describes the process, not the string
This is the single most important — and most often botched — idea in password strength. Entropy is a measure of how a password was generated, not a property you can read off the finished string. "correct horse battery staple" and "Tr0ub4dor&3" look different, but the only honest entropy calculation is the one that asks how many equally likely passwords the generator could have produced. That is why this tool has no box to type a password into: a charset calculation applied to a human-chosen password is meaningless, because humans do not choose uniformly at random. It would give "P@ssw0rd123" a flattering score while a cracker's dictionary breaks it in milliseconds.
The two honest cases
When a password really is generated at random, the math is exact. For a random string, entropy = length × log₂(charset size): a 16-character password drawn from 62 characters (letters and digits) carries 16 × log₂(62) ≈ 95 bits. For a diceware passphrase, entropy = words × log₂(list size): six words from the 7776-word EFF list is 6 × 12.9 ≈ 77 bits — and far easier to type and remember than a 13-character random string of similar strength.
Reading the crack-time table
The same password can be uncrackable or trivial depending entirely on how the defender stored it. The scenarios span four orders of magnitude in guess rate:
| Scenario | Guesses/sec | Why |
|---|---|---|
| Online, rate-limited | ~100 | a login form that locks out after failures |
| Online, unthrottled | ~10⁴ | an API with no lockout |
| Offline, bcrypt/argon2 | ~10⁵ | a stolen database hashed slowly on purpose |
| Offline, SHA-256 GPU | ~10¹⁰ | a fast general hash on a GPU rig |
| Offline, MD5/NTLM GPU | ~10¹² | a broken-but-common fast hash |
The lesson: how a site stores your password (slow hash vs. fast hash) matters more than a few extra characters. These rates are order-of-magnitude figures for a single modern GPU rig in 2026; they only rise over time, which is why leaving headroom is wise.
Practical advice
Length beats complexity, and randomness beats cleverness. The reliable recipe is a password manager generating long random strings for every site, plus a memorized diceware passphrase for the manager itself. No calculator, including this one, can rescue a password you chose by hand.
Related tools: the hash generator shows the fast hashes (MD5, SHA) whose speed is the whole story of the offline columns above.