What "128 bits" actually means
Entropy is a count of how many equally likely possibilities something was drawn from, written as a power of two. Change the numbers below and watch the figure move — and see why length beats complexity every single time.
Every figure here assumes the choices were made at random by a machine. A password you invented is not drawn from 95 characters per position — it is drawn from the far smaller set of things a person thinks of, and attackers have spent decades enumerating exactly that set. There is no honest way to compute the entropy of a human-chosen password, and any tool claiming to is estimating, not counting.
Processed locally in your browserNothing you enter here is uploaded, logged or sent to any server.
The arithmetic, which is all of it
For a single choice from n equally likely options, the entropy is log₂(n) bits. One coin flip is 1 bit; one die roll is log₂(6) ≈ 2.58; one letter from 26 is log₂(26) ≈ 4.70.
For k independent choices from the same set, multiply: k × log₂(n). Independent is doing real work in that sentence — it means each choice is made afresh, with the full range available. Picking words without repeats, or avoiding a character you already used, breaks it and makes the true figure lower than the formula says.
That is the entire theory. Everything else on this page is arithmetic with those two lines.
Length against complexity, done properly
Both help, and the usual slogan gets the comparison wrong in both directions. Here is the actual arithmetic.
Adding one character to a password over an alphabet of n gains log₂(n) bits — a flat amount, regardless of how long the password already is. Enlarging the alphabet from 26 to 95 gains 1.87 bits per character, so its total value is 1.87 × the length: bigger the longer the password, and worth nothing at all on a password of one character.
They break even when the extra characters number about two-fifths of the length. On a 16-character password, moving from lower-case to the full keyboard is worth roughly the same as six more lower-case characters — and six more lower-case characters are far easier to type, remember and dictate than a keyboard full of punctuation.
So: complexity is not worthless, and the slogan that says so is overstating it. The honest version is that length is the cheaper way to buy the same thing, and it is the only one that keeps scaling. The panel above works this out for whatever length you set.
Why there are no crack times here
Because a crack time is a claim about an attacker, not about a secret. How long something survives depends on how it was stored — a password behind bcrypt at a high cost factor and the same password behind an unsalted MD5 are different problems by a factor of billions — on what hardware is guessing, and on whether anybody is guessing at all rather than reading it out of a breach.
Entropy is the part that can be stated honestly: how many possibilities there were. What that is worth is a question about the system holding it, and a page in your browser does not know the answer.
Numbers worth carrying around
Below 40 bits — reachable by anyone who can guess offline at speed. Not a security control.
40 to 60 — depends entirely on how it is stored. Fine behind a rate limit; thin behind a leaked database.
Around 80 — beyond bulk offline guessing with hardware that exists. This is where a secret stops being the weak link.
128 — the standard target for cryptographic keys. There is no attack and there is not going to be one; the sun runs out first.
256 — chosen for margin rather than need, including against hypothetical quantum machines, which halve the effective strength of a symmetric key.
Where the numbers come from
A six-sided die is 2.58 bits, so five rolls give 12.9 — which is exactly the per-word figure quoted for Diceware, because that is what a Diceware word is: five dice rolls indexing a list of 7,776 words. The passphrase generator here uses a smaller list and says so, which is why it defaults to more words.
Related
The password generator counts this for real passwords including what each option costs, and the random generator produces values at whatever size you settle on.
Questions people actually ask
What is a bit of entropy?
A doubling of the possibilities. One bit means two equally likely options, ten bits means 1,024, and 128 bits means about 3.4 × 10³⁸. The formula is log₂(n) for one choice from n options, and k × log₂(n) for k independent choices — that is the whole theory.
Can this tell me how strong my password is?
No, and neither can anything else honestly. Every figure here assumes a machine made the choices at random. A password you invented is drawn from the much smaller set of things people think of, which attackers have spent decades enumerating. A tool that computes entropy for a human-chosen password is estimating from a model, not counting.
Is it true that length beats complexity?
Mostly, but the usual version of the claim is sloppy and this page does the arithmetic instead. One extra character gains log₂(alphabet) bits — a flat amount. Enlarging the alphabet from 26 to 95 gains 1.87 bits per character, so its total value grows with length. They break even at about two-fifths of the length: on a 16-character password, going to the full keyboard is worth roughly six more lower-case characters. Complexity is not worthless — length is just the cheaper way to buy the same thing, and the only one that keeps scaling.
Why no crack times?
Because a crack time describes an attacker, not a secret. The same password behind bcrypt at a high cost and behind an unsalted MD5 differ by a factor of billions, and neither is knowable from a page in your browser. Entropy is the part that can be stated honestly.
Where does 12.9 bits per word come from?
A Diceware word is five rolls of a six-sided die indexing a list of 7,776 words, and log₂(7776) = 12.925. It is exactly five times log₂(6). The passphrase generator on this site uses a smaller list, says so, and defaults to more words to compensate.
Is 256 bits twice as good as 128?
No — it is 2¹²⁸ times as many possibilities, which is an unimaginable multiple of an already unreachable number. 128 bits has no feasible attack. 256 is chosen for margin, including against hypothetical quantum machines that would halve a symmetric key's effective strength.