Password entropy calculator
A 12-character password drawn at random from 95 printable characters carries about 78.84 bits, rated strong. Enter the pool size and length of a password rule to compare policies in bits, without typing any real password. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Worked example
- Length
- 12
- Charset size
- 95
- Bits per character
- 6.569856
- Entropy bits
- 78.838267
- Strength
- strong
Password entropy is the information-theoretic measure of how many bits of unpredictability a randomly chosen secret carries. This password entropy calculator does not ask you to paste a password. It takes two policy numbers: the size of the character set the password is drawn from, and the password length in characters. Shannon entropy is then H = L × log2(N) bits. The tool returns that value together with a strength label from very weak through very strong.
Shannon entropy, character set size, and why length usually wins
Shannon password entropy treats a password as a string of length L drawn independently and uniformly from an alphabet of N symbols. Each character then contributes log2(N) bits, so the whole secret carries H = L × log2(N) bits. Character set size is not the number of distinct glyphs that happen to appear in one password; it is the size of the pool the generator is allowed to use.
A lowercase English alphabet is 26. Mixed case is 52. Letters plus digits are 62.
Printable ASCII is typically 95. A full byte is 256. Diceware-style word lists use the word-list length as N and the number of words as L.
Because the model assumes uniform independent draws, it is an upper bound: a memorable phrase, a keyboard walk, or a leaked password has far less entropy than the formula suggests for the same length and apparent charset. Policy designers still use H because it answers a different question than a strength checker: given a generation rule, how large is the search space. Doubling length adds another full log2(N) bits; doubling the alphabet only adds one extra bit per character when N doubles.
That is why a twelve-character printable-ASCII secret outruns an eight-character mixed-case password even though both look complex.
What you can do with it
Password-policy design
Compare generation rules (length and charset size) in bits before publishing a composition policy or recovery-code format.
Labs and compliance notes
Give students and auditors a deterministic H = L × log2(N) oracle that rejects a non-positive length instead of silently returning zero.
FAQ
How is password entropy calculated from charset size and length?
Shannon entropy is H = L × log2(N) bits, where L is the password length and N is the character-set size. The password itself is never sent.
What character set sizes should I use?
Use the pool the generator is allowed to pick from: 10 for digits, 26 lowercase, 52 mixed case, 62 alphanumeric, 95 printable ASCII, 256 for a full byte. Word lists use the list length as N and the word count as L.
What happens if length is not a positive integer?
Zero, negatives, fractions, empty values, and missing length are all rejected.
How does the strength label map to bits?
Below 28 bits is very weak, 28–36 weak, 36–60 fair, 60–128 strong, and 128 bits or more very strong. These bands describe uniformly random secrets; a chosen password can be weaker.
Why does length matter more than adding character types?
Each extra character adds a full log2(N) bits, while doubling the pool adds only one bit per character. That is why a twelve-character password from printable characters beats an eight-character mixed-case one.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/security/password-entropy \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"length":12,"charset_size":95}'const res = await fetch("https://api.kit.forhosting.com/security/password-entropy", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"length": 12,
"charset_size": 95
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/security/password-entropy",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"length": 12,
"charset_size": 95
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/security/password-entropy", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"length":12,"charset_size":95}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"length":12,"charset_size":95}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/security/password-entropy", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"length": 12,
"charset_size": 95
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "security.password_entropy",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Use it when designing password policies, PIN lengths, recovery codes, or API-key formats. Length that is not a positive integer is rejected with invalid_input.
Shannon entropy, character set size, and why length usually wins
The calculator reports bits_per_character as log2(N) so you can see the per-glyph contribution next to the total.
Input contract, strength labels, and error behaviour
Length that is not a positive integer is the contract the landing promises: the task is not billed. Values above one million are rejected as out of range for a policy parameter. Strength uses the usual information-theoretic bands: below 28 bits is very weak, 28 up to 36 is weak, 36 up to 60 is fair, 60 up to 128 is strong, and 128 bits or more is very strong. A one-character alphabet is mathematically allowed and returns zero bits with the label very weak. POST a JSON body with two required positive integers: length, the password length in characters, and charset_size, the size of the generating alphabet. Aliases length, password_length, and l are accepted for the first field; charset_size, charset, pool, alphabet_size, and pool_size for the second. Each value may arrive as a JSON integer or as a numeric string of digits. Missing fields, empty strings, booleans, objects, fractions such as 12.5, zero, and negative numbers fail with invalid_input naming the field. On success the body echoes length and charset_size, reports bits_per_character as log2 of the pool, entropy_bits as L times that quantity rounded to six decimal places for stable goldens, a strength label, and the formula string H = L * log2(N). Example: length 12 and charset_size 95 (printable ASCII) yields about 78.84 bits and the label strong. Length 8 and charset_size 26 (lowercase only) yields about 37.60 bits and the label fair.
Where a password-entropy API earns its keep
Security teams use a password entropy calculator when writing generation policy, not when a user is typing a secret into a login form. Identity platforms pick PIN length and digit-only versus alphanumeric recovery codes by asking how many bits the rule actually produces. Failed validation does not consume balance. If you need to score a concrete password a user already chose, including common-password lists and crack-time estimates, that is a different search intent and a different tool. Hardware-token and API-key designers compare a 22-character base62 secret with a 16-byte hex string on a single scale. Compliance write-ups that must cite Shannon bits next to a password-composition rule can call this endpoint instead of spreading a spreadsheet formula that someone will copy with a natural log by mistake. Keep requests small, pin the rounded entropy_bits in tests, and you get a reproducible policy oracle for handbooks, LMS labs, and edge workers without standing up a cryptography library of your own.
Integration use cases
PIN and API-key sizing
Size numeric PINs, base62 API keys, and hex tokens on one Shannon scale instead of mixing digit counts with folklore about complexity.
Technical questions
What does the password entropy calculator cost?
The browser tool is free. API requests use prepaid KIT balance at $0.002 per successful call; invalid input is not billed.