PasswordForge · password strength
How strong is a 6-character password?
A random 6-character password carries between 28.2 and 38.7 bits of entropy, depending on which characters it may contain. The table below gives the exact figure for each alphabet, and what each attack speed would need to exhaust it.
These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.
Entropy and keyspace
| Alphabet | Entropy | Possible passwords | Verdict |
|---|---|---|---|
| Lowercase letters (a-z) | 28.2 bits | 308,915,776 | weak |
| Letters, both cases (A-Z a-z) | 34.2 bits | 19,770,609,664 | weak |
| Letters and digits (A-Z a-z 0-9) | 35.7 bits | 56,800,235,584 | weak |
| Letters, digits and symbols | 38.7 bits | 433,626,201,009 | weak |
Time to exhaust half the keyspace
Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.
| Attack | 28.2b | 34.2b | 35.7b | 38.7b |
|---|---|---|---|---|
| Online, rate-limited (10 guesses/sec) | 179 days | 31 years | 90 years | 687 years |
| Online, no throttling (1 000/sec) | 1.8 days | 114 days | 329 days | 6.9 years |
| Offline, slow hash — bcrypt cost 12 (20 000/sec) | 2.1 hours | 5.7 days | 16 days | 125 days |
| Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec) | under a second | under a second | under a second | 2.2 seconds |
| Offline, well-funded (100 trillion/sec) | under a second | under a second | under a second | under a second |
Generate one at this strength
The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.
Open PasswordForgeOther strength questions
- How strong is an 8-character password?
- How strong is a 10-character password?
- How strong is a 12-character password?
- How strong is a 14-character password?
- How strong is a 16-character password?
- How strong is an 18-character password?
- How strong is a 20-character password?
- How strong is a 24-character password?
- How strong is a 32-character password?
- How strong is a 4-digit PIN?
- How strong is a 6-digit PIN?
- How strong is an 8-digit PIN?