// free · runs in your browser · nothing uploaded
How Strong Is Your Password? Entropy and Guessing Time by Length and Type
The entropy and the average time to guess a random password at 100 billion guesses a second, from a 6-digit PIN to a 32-character API key.
1. Options
Your passwords
very strong · 129 bits · a fast attacker would need about longer than the age of the universe to guess it
Tips
- Use a different password for every account, and save them in a password manager.
- 16 or more characters is strong for most accounts. Use 20+ for email and banking.
- Turn on two-step verification wherever you can.
Passwords are made by your browser's secure random generator (crypto.getRandomValues) and never leave your device. We cannot see them.
📚 Official sources: Web Crypto getRandomValues
We build every tool from the official rules and re-check them when they change. Always confirm with the official source before you rely on a result.
🛠️ Spotted a mistake or an out-of-date rule? Tell us
Length matters most
Each extra character multiplies the number of possible passwords by the size of the character set, so a longer password beats a more complicated short one. These figures are for passwords picked at random by a generator; human-made passwords are far weaker than their length suggests.
| Password | Entropy | Strength | Average time to guess |
|---|---|---|---|
| 8 characters, all sets | 52 bits | weak | 4.6 hours |
| 12 characters, all sets | 77 bits | good | 30 thousand years |
| 16 characters, all sets | 103 bits | strong | longer than the age of the universe |
| 20 characters, all sets | 129 bits | very strong | longer than the age of the universe |
| 16 letters and digits (easy to type) | 93 bits | strong | 1.5 billion years |
| 6-digit PIN | 20 bits | very weak | instantly |
| 32 letters and digits (API key) | 191 bits | very strong | longer than the age of the universe |
Related tools
Questions people ask
Is it safe to make a password on a website?+
Here, yes: the password is made by your own browser with its secure random generator (crypto.getRandomValues) and is never sent anywhere. You can even turn off your internet after the page loads and it still works.
How long should my password be?+
At least 16 random characters for normal accounts, and 20 or more for email, banking and your password manager. Length adds more strength than symbols do.
What does 'bits' mean?+
Bits measure how many guesses an attacker would need. Each extra bit doubles the work. Around 80 bits or more is strong enough that guessing is not realistic today.
Why avoid look-alike characters?+
Characters like I, l and 1, or O and 0, are easy to mix up when you read a password aloud or type it from paper, for example a Wi-Fi password. Removing them makes typing easier and only slightly lowers the strength.