How this calculator works
- Step 1Pick the character kinds4 kindsLetters, capitals, digits and symbols.
- Step 2Draw each characterSecure randomnessFrom crypto.getRandomValues, with no bias towards any character.
- Step 3Keep only complete onesEach kind oncePasswords missing a chosen kind are thrown away and redrawn.
- Step 4Count every possibility99.7 bitsEntropy is log₂ of the number of passwords that could appear.
Entropy measures how many guesses an attacker would need, in powers of two. Each extra bit doubles the work. Here it is calculated exactly, not estimated from a formula of thumb.
Worked example: 16 characters
A 16-character password from all four kinds is one of about 2^99 possibilities.
- Inclusion–exclusion
Σ (−1)^k × (size of the remaining kinds)^16
- Characters available76
- All 16-character strings76^16
- Minus those missing one or more kindsinclusion–exclusion
- Entropy99.74 bits
Reading the result
Adding length raises entropy faster than adding symbols.
- Under 60 bitsWeak or fairA 6-digit PIN is about 20 bits; only safe with strict lock-outs.
- 80 bits and moreVery strongFar beyond practical guessing for any website password.
Related security tools
A strong password is random and long. Identifiers and hashes are different tools.
To make unique IDs that are not secret, use the UUID generator. The hash generator checks a file’s checksum, and the random number generator draws numbers from a range.
Common mistakes
Mistake: Reusing one strong password on many sites.
Instead: Use a different password for every account, kept in a password manager.
Mistake: Adding one symbol to a short word.
Instead: Use a long random password; length matters most.
Mistake: Sending passwords in chat or email.
Instead: Share through a password manager, or by phone.
Read how we test our calculators, or browse more developer tools.