Loading page content...
Last updated:
Reviewed by CalculatorApp.me Cybersecurity Team
Entropy, brute-force resistance, NIST guidelines, and what makes a password truly unbreakable.
128 bits
Recommended minimum password entropy
3 billion
Compromised credentials in Have I Been Pwned
2.5 seconds
Time to crack 8-char lowercase password (2024 GPU)
550 yrs+
Time to crack 16-char random password
A secure password is one that is unpredictable (not derived from known patterns or personal information) and has high entropy — the measure of how many possible combinations an attacker must try to guess it. Every additional character exponentially multiplies the search space.
Modern attacks use GPU-accelerated cracking (e.g., Hashcat with RTX 4090) capable of testing 164 billion MD5 hashes per second — making short passwords catastrophically weak regardless of character variety. Length is now considered more important than character complexity alone.
NIST SP 800-63B (2017, updated 2024) fundamentally revised recommendations: prioritize length (minimum 8, recommend 15+), disallow periodic forced rotation, check against breach lists, and abandon complexity rules that produce predictable patterns (e.g., P@ssw0rd!).
H = L × log₂(N) H = entropy in bits L = password length N = character set size Example: 12 chars, all ASCII printable (95): H = 12 × log₂(95) = 12 × 6.57 = 78.9 bits
Each additional character adds log₂(N) bits of entropy. Longer is exponentially stronger.
Lowercase a–z: 26 chars (4.70 bits/char) Lowercase + uppercase: 52 chars (5.70 bits/char) + Numbers: 62 chars (5.95 bits/char) + Symbols: 94–95 chars (6.57 bits/char) Passphrase 5 words (from 7776-word list): H = 5 × log₂(7776) = 5 × 12.92 = 64.6 bits
Passphrases (random words) are often more memorable AND more secure than short complex passwords.
Combinations = N^L Time = Combinations ÷ hash_rate RTX 4090 bcrypt (cost 12): ~184K/sec RTX 4090 MD5: ~164B/sec MD5, 8 chars, full ASCII: 95^8 = 6.6×10¹⁵ ÷ 164B = ~11 hours avg
Hashing algorithm matters enormously. bcrypt/Argon2/scrypt are designed to be slow — protecting even shorter passwords.
- First character: 4 bits - Characters 2–8: 2 bits each (14) - Characters 9–20: 1.5 bits each - Characters 21+: 1 bit each - Dictionary check: −6 bits - NIST notes: this model is outdated; prefer measuring character set entropy instead
NIST 800-63B now recommends against complexity rules and mandatory rotation. Focus on length + breach checking.
| Guideline | Old Recommendation | NIST Current Guidance (800-63B) |
|---|---|---|
| Minimum length | 8 characters | 8 minimum; 15+ recommended; 64+ maximum |
| Complexity rules | Upper+lower+number+symbol required | NOT required (produces predictable patterns) |
| Mandatory rotation | Every 90 days | Only if compromise is suspected |
| Password hints | Allow | Disallow |
| Security questions | Allow | Disallow |
| Breach database check | Not standard | Required — check against known compromised credentials |
| MFA | Optional | Strongly recommended |
Fernando Corbató's CTSS time-sharing system at MIT introduced the first computer password system to protect users' files from each other.
Unix's crypt() implemented hashed password storage using a modified DES algorithm — the first mainstream password hashing system, still seen in /etc/shadow.
At RSA Conference 2004, Bill Gates predicted passwords would 'not be able to meet the challenge' of security — a prediction still being proven true 20 years later.
170M+ LinkedIn password hashes (SHA-1, no salt) were cracked within hours of leaking, revealing the systemic failure of weak hashing functions.
NIST fundamentally revised password recommendations: no mandatory rotation, no complexity rules, minimum 8 characters, maximum 64+, breach database checking required.
FIDO2/WebAuthn passkeys (Apple, Google, Microsoft) use public-key cryptography — no password transmitted or stored — beginning the gradual end of the password era.
NIST SP 800-63B
The authoritative US government standard for password requirements, superseding outdated complexity rules with length and breach-checking mandates.
Verizon DBIR 2023
81% of hacking-related breaches involved stolen or weak credentials. Credential stuffing attacks doubled year-over-year.
Have I Been Pwned
Over 847M unique compromised passwords from breaches. Free API for checking if a password has appeared in a known data breach.
FIDO Alliance
Passkeys use public-key cryptography to authenticate users without passwords, eliminating phishing, credential stuffing, and replay attacks entirely.
Changing passwords frequently makes them more secure.
NIST 800-63B explicitly recommends AGAINST mandatory periodic rotation unless compromise is suspected. Forced rotation leads to predictable patterns (Password1 → Password2!) and post-it notes.
P@ssw0rd! is a strong password because it has symbols and numbers.
Dictionary-based substitutions (@ for a, 0 for o) are fully known to crackers. P@ssw0rd! would be cracked in seconds by any modern attack.
A short complicated password is better than a long simple one.
Entropy depends on both length and character space. 'correct-horse-battery-staple' (4 words, 28 chars) has ~44 bits of entropy — far stronger than 'Tr0ub4dor&3' (28 bits).
Password managers are risky because all your passwords are in one place.
A reputable password manager (Bitwarden, 1Password) with a strong master password is vastly safer than reusing passwords or writing them on paper. Zero-knowledge architecture means the provider cannot see your vault.
Strong passwords, secure generators, and digital tools — everything to stay safe online.
Browse All Tools →Generate strong, random passwords, passphrases, and PINs. Analyze password strength with entropy calculation and estimated crack time.
Enter values above to see results.