Reading the entropy figure
The bands below are a presentational grouping of the bit count, chosen to separate passwords that fall to offline attack from those that do not. The consequences shown beside them are computed from the entropy, not assigned.
| Entropy | Band | What it means in practice |
|---|---|---|
| Below 40 bits | Weak | Exhaustible almost immediately by an offline attack |
| 40 – 59 bits | Fair | Resists casual attack; falls to a determined offline one |
| 60 – 79 bits | Strong | Beyond routine offline attack against a well-chosen hash |
| 80 bits and above | Very strong | Exhaustive search is not the weak point; reuse and phishing are |
- The password is generated in your browser using the platform's cryptographically secure random source, and is deliberately excluded from every analytics and AI feature on this site. It is never transmitted.
- NIST SP 800-63B advises verifiers not to require mixtures of character types and not to force periodic password changes, but to force a change where there is evidence of compromise.
What password entropy measures
Entropy measures how many equally likely passwords the generator could have produced, expressed in bits. A generator drawing each character independently from a pool of N characters to a length L has an entropy of L x log2(N) bits, and each additional bit doubles the number of candidates an attacker must try.
Entropy is a property of the generator, not of the string it produced. A particular password does not have an entropy of its own — the question is only how large the space it was drawn from was. This is why a password you invented yourself cannot honestly be assigned a bit count, and why generated passwords can be.
This is also why length beats complexity. Adding one character to a 20-character password drawn from 76 symbols adds about 6.2 bits; adding a whole extra character class to a short password adds far less. NIST's guidance reflects that: SP 800-63B tells verifiers they should not impose composition rules requiring mixtures of character types, and should permit passwords of at least 64 characters.
How to use the password generator
- Choose a length. Longer is the most effective single change you can make.
- Select which character classes to include. Each one enlarges the pool and so raises the entropy per character.
- Exclude look-alike characters if the password will be read aloud or copied by hand — this trades a little entropy for fewer transcription errors.
- Read the entropy figure. It is the honest measure of strength; the years-to-exhaust figure is that same number expressed as a duration.
- Store the password in a password manager rather than reusing it. Reuse defeats any amount of entropy.
The formula behind the entropy figure
Each character is drawn independently and uniformly from the pool, so the number of possible passwords is the pool size raised to the length. Entropy is the base-2 logarithm of that count.
The time figure assumes an offline attack against a fast, poorly protected hash at a trillion guesses per second, and reports the expected time to search half the space. It is an illustration of scale, not a prediction: a properly stretched password hash is orders of magnitude slower to attack, and a leaked plaintext password takes no time at all.
Common mistakes
- Adding a character class instead of length. Length raises entropy far faster.
- Reusing a strong password across sites. A breach at one service then compromises all of them, whatever the entropy.
- Substituting characters in a familiar word — writing 'P@ssw0rd' for 'password'. Cracking tools apply exactly these substitutions.
- Assuming a strength meter's verdict on a password you invented is an entropy measurement. Entropy describes a generator, not a string.
- Changing passwords on a schedule for its own sake, which NIST advises against; change on evidence of compromise instead.
よくある質問
How long should a password be?
NIST SP 800-63B sets a floor of 8 characters for a user-chosen password and requires verifiers to permit at least 64. For a generated password, length is the lever that matters most: at a 76-character pool, each additional character adds about 6.2 bits of entropy, doubling the search space roughly every character.
What is password entropy in bits?
It is the base-2 logarithm of the number of passwords the generator could have produced: length x log2(pool size). A 20-character password drawn from a 76-character pool carries 20 x log2(76) = 125 bits. Each extra bit doubles the number of candidates an attacker must test.
Does mixing character types make a password stronger?
It enlarges the pool, so it raises entropy per character — but far less than length does, and NIST SP 800-63B explicitly advises verifiers not to impose composition rules requiring such mixtures. A long passphrase from a single class beats a short password from four.
Is the password sent anywhere?
No. It is generated in your browser from the operating system's cryptographically secure random source, and this calculator is specifically excluded from the result-publishing that feeds the site's other features, so it is never transmitted or logged.
Should I change my passwords regularly?
NIST SP 800-63B advises against arbitrary periodic change, on the grounds that it pushes people towards predictable variations. It does require a change where there is evidence that the credential has been compromised. Unique passwords per site, held in a password manager, do more good than a rotation schedule.
参考文献
- Grassi PA, Garcia ME, Fenton JL. NIST Special Publication 800-63B: Digital Identity Guidelines — Authentication and Lifecycle Management. National Institute of Standards and Technology, 2017 (with subsequent errata). Section 5.1.1 on memorized secrets.
- Shannon CE. A Mathematical Theory of Communication. Bell System Technical Journal 1948; 27(3): 379-423 — entropy as a measure of uncertainty.
- World Wide Web Consortium. Web Cryptography API — Crypto.getRandomValues(), the cryptographically strong random source used here. w3.org.
- National Cyber Security Centre (UK). Password policy: updating your approach. ncsc.gov.uk.