Password Strength Calculator
See how strong a random password or passphrase is, in bits, and roughly how long it would take to guess, without typing your password anywhere.
Strength
71.5 bits, strong
- Average time to guess
- 511 years
- Possible passwords
- about 10^21
A random 12-character password has 71.5 bits of strength: on average, 511 years to guess at this rate.
How it's worked out
- Possible passwords
62^12about 10^21 - Strength in bits
12 × log₂ 6271.5 bits - Average time to guess
half of about 10^21 ÷ 100,000,000,000 guesses a second511 years
The same password against each attack
| Attack | Average time to guess |
|---|---|
| Someone guessing at a login page (about 100 a second) | 511.2 billion years |
| Stolen password file, well protected (about 10 thousand a second) | 5.1 billion years |
| Stolen password file, weakly protected (about 100 billion a second) | 511 years |
- Nothing is typed in here: this works only from the length and the kind of characters, so your password never leaves your head.
- The figures hold only for passwords picked at random by a generator or dice. Names, words and patterns that people choose are guessed far faster.
- Use a different password for every site, and turn on two-step sign-in where you can.
How it is worked out
A random password with L characters, each picked from N choices, has N^L possibilities. Its strength in bits is L × log₂ N. On average an attacker finds it after trying half of the possibilities, so the time is half of N^L divided by the guesses a second.
The guessing rates
The rates are rough examples: a login page that limits attempts allows few guesses, while a stolen file of weakly protected passwords can be attacked by computers making billions of guesses a second.
Questions people ask
How strong is a random 12-character password of letters and digits?
About 71.5 bits. Guessing 100 billion times a second, it would take around 500 years on average.
Is a 5-word passphrase strong?
Five words picked at random from the 7,776-word dice list give about 64.6 bits, enough against a login page or a well-protected password file, but only a few years against the fastest attacks on a weakly protected one. Six words give about 77.5 bits.
Do I type my password in?
No. The calculator only needs the length and the kind of characters, so your password stays private.
Why don't these figures apply to my own made-up password?
They assume every character or word is picked at random. Passwords people choose follow patterns, such as names, dates and swapping letters for numbers, which attackers try first.
About this calculator
Formula and rules last checked 10 November 2026Written and tested by the CalculatorDex teamReport a problem