PasswordForge · password strength
How strong is a 14-character password?
A random 14-character password carries between 65.8 and 90.2 bits of entropy, depending on which characters it may contain. The table below gives the exact figure for each alphabet, and what each attack speed would need to exhaust it.
These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.
Entropy and keyspace
| Alphabet | Entropy | Possible passwords | Verdict |
|---|---|---|---|
| Lowercase letters (a-z) | 65.8 bits | 6.45×10^19 | strong |
| Letters, both cases (A-Z a-z) | 79.8 bits | 1.06×10^24 | strong |
| Letters and digits (A-Z a-z 0-9) | 83.4 bits | 1.24×10^25 | great |
| Letters, digits and symbols | 90.2 bits | 1.42×10^27 | great |
Time to exhaust half the keyspace
Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.
| Attack | 65.8b | 79.8b | 83.4b | 90.2b |
|---|---|---|---|---|
| Online, rate-limited (10 guesses/sec) | 1.0×10^11 years | 1.7×10^15 years | 2.0×10^16 years | 2.3×10^18 years |
| Online, no throttling (1 000/sec) | 1.0×10^9 years | 1.7×10^13 years | 2.0×10^14 years | 2.3×10^16 years |
| Offline, slow hash — bcrypt cost 12 (20 000/sec) | 5.1×10^7 years | 8.4×10^11 years | 9.8×10^12 years | 1.1×10^15 years |
| Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec) | 10 years | 167,461 years | 2.0×10^6 years | 2.3×10^8 years |
| Offline, well-funded (100 trillion/sec) | 3.7 days | 167 years | 1,965 years | 225,494 years |
Generate one at this strength
The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.
Open PasswordForgeOther strength questions
- How strong is a 6-character password?
- How strong is an 8-character password?
- How strong is a 10-character password?
- How strong is a 12-character password?
- How strong is a 16-character password?
- How strong is an 18-character password?
- How strong is a 20-character password?
- How strong is a 24-character password?
- How strong is a 32-character password?
- How strong is a 4-digit PIN?
- How strong is a 6-digit PIN?
- How strong is an 8-digit PIN?