PasswordForge · password strength
How strong is a 12-character password?
A random 12-character password carries between 56.4 and 77.3 bits of entropy, depending on which characters it may contain. The table below gives the exact figure for each alphabet, and what each attack speed would need to exhaust it.
These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.
Entropy and keyspace
| Alphabet | Entropy | Possible passwords | Verdict |
|---|---|---|---|
| Lowercase letters (a-z) | 56.4 bits | 9.54×10^16 | fair |
| Letters, both cases (A-Z a-z) | 68.4 bits | 3.91×10^20 | strong |
| Letters and digits (A-Z a-z 0-9) | 71.5 bits | 3.23×10^21 | strong |
| Letters, digits and symbols | 77.3 bits | 1.88×10^23 | strong |
Time to exhaust half the keyspace
Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.
| Attack | 56.4b | 68.4b | 71.5b | 77.3b |
|---|---|---|---|---|
| Online, rate-limited (10 guesses/sec) | 1.5×10^8 years | 6.2×10^11 years | 5.1×10^12 years | 3.0×10^14 years |
| Online, no throttling (1 000/sec) | 1.5×10^6 years | 6.2×10^9 years | 5.1×10^10 years | 3.0×10^12 years |
| Offline, slow hash — bcrypt cost 12 (20 000/sec) | 75,599 years | 3.1×10^8 years | 2.6×10^9 years | 1.5×10^11 years |
| Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec) | 5.5 days | 62 years | 511 years | 29,792 years |
| Offline, well-funded (100 trillion/sec) | 8 minutes | 23 days | 187 days | 30 years |
Generate one at this strength
The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.
Open PasswordForgeOther strength questions
- How strong is a 6-character password?
- How strong is an 8-character password?
- How strong is a 10-character password?
- How strong is a 14-character password?
- How strong is a 16-character password?
- How strong is an 18-character password?
- How strong is a 20-character password?
- How strong is a 24-character password?
- How strong is a 32-character password?
- How strong is a 4-digit PIN?
- How strong is a 6-digit PIN?
- How strong is an 8-digit PIN?