Password entropy calculator

Entropy is log2(pool^length): the number of bits needed to describe one password drawn at random under a given rule. It is the right tool for judging a policy — "minimum twelve characters, letters and digits" — because it asks about the rule rather than about any particular password.

Two policies that sound similar can differ enormously. Eight characters of mixed case and digits is about 48 bits; twelve of plain lowercase is about 56. Length is the cheaper lever almost every time, which is why current guidance from NIST is to raise minimum length and drop composition rules — the rules push people toward predictable patterns without buying much. The figure here is an upper bound in the same way as any entropy number: it holds if passwords really are chosen randomly under the rule, and overstates things when they are not.