Entropy → Crack Time

Enter an entropy value in bits to see how long an attacker would need under three attack scenarios — from a throttled website login to a massive cloud cluster.

All calculation happens locally. Nothing is uploaded or stored.
Try 40, 60, 80, or 100 bits.

Time to crack

Attack scenario Time
Online (throttled) · 100/sec —
Offline GPU · 10¹⁰/sec —
Cloud cluster · 10¹²/sec —

Reference table (40–100 bits)

Entropy (bits) Online 100/s GPU 10¹⁰/s Cluster 10¹²/s
————

What entropy means

Entropy, measured in bits, is the standard way to express password strength. Each additional bit doubles the number of possible passwords an attacker must try. A 40-bit password has about a trillion (10¹²) possibilities; a 100-bit password has roughly 10³⁰ — an astronomically larger search space. In practice, 40 bits is weak, 60 bits is moderate, 80 bits is strong, and 100 bits is excellent.

Why attack speed matters

The same entropy value gives wildly different crack times depending on the attacker's resources. An online attacker is limited by the target site's login rate limit (we model 100 guesses per second). An offline attacker who has stolen a database of password hashes can use a GPU to try about 10 billion (10¹⁰) guesses per second. A cloud cluster of many machines can reach 10¹² per second. This is why a 60-bit password that survives for decades online might fall in under a minute offline.

How to read the table

Find your password's entropy (use the strength checker to measure it), then look up the corresponding row. The times shown are the average to exhaust the entire keyspace; a real attacker gets lucky in roughly half that on average. Treat these figures as relative guidance, not precise guarantees — they ignore smarter attacks like dictionary or credential-stuffing attempts.

Explore more tools