Password Entropy & Brute-Force Crack Time Calculator

Password entropy is an information-theoretic metric derived from Claude Shannon's mathematical framework that quantifies the unpredictability and cryptographic strength of a credential in bits. Unlike legacy complexity rules that merely enforce predictable character substitutions, entropy measures the true combinatorial keyspace an adversary must exhaust during a brute-force attack. For a uniformly generated random password, entropy is defined by the formula E = L × log2(R), where L denotes the password length and R represents the size of the active character pool. The pool size R is determined by summing the distinct character sets enabled during generation: lowercase letters (a–z) contribute 26 characters, uppercase letters (A–Z) contribute 26 characters, numeric digits (0–9) add 10 characters, and standard printable symbols add 26 to 32 characters. When all four character classes are active (R ≈ 88–94), each additional character of password length adds approximately 6.5 bits of entropy, multiplying the total brute-force search space by nearly two orders of magnitude per character. In modern identity and access management standards (NIST SP 800-63B), real-world resistance against offline credential cracking depends heavily on the server-side password hashing algorithm. Fast, unsalted message digests such as MD5, SHA-256, or legacy NTLM can be evaluated at tens of billions of guesses per second on multi-GPU cracking rigs, whereas memory-hard key derivation functions such as Argon2id, bcrypt, and PBKDF2 intentionally throttle evaluation speeds to thousands of hashes per second. Consequently, contemporary security engineering prioritizes credential length and true randomness over predictable human substitution patterns (such as replacing 'a' with '@' or appending '123!') that dictionary rule engines crack in milliseconds. While 60 to 75 bits of entropy suffices for standard user accounts protected by rate-limiting and multi-factor authentication (MFA), privileged infrastructure secrets—including Linux root passwords, LUKS/ZFS disk encryption passphrases, and HMAC signing keys vulnerable to offline cracking—require 100 to 128+ bits of CSPRNG-generated entropy.