Passphrase strength

How many combinations a randomly chosen passphrase or password has, from its length and the list it was drawn from. It never asks for the password itself.

Assumptions behind the numbers

• This page never asks for your password and cannot see it. It counts only.
• Bits = count × log2(list size). Each bit doubles the number of combinations. The figures hold only when every word or character was picked at random, by dice or by a generator.
• A phrase a person made up, a quotation, a song line or a name with a number is weaker than its count suggests, because people pick predictable words. The calculator says nothing about such a password.
• EFF's long list has 7,776 words, so each word adds about 12.9 bits; EFF suggests six words (EFF, Dice-Generated Passphrases).
• NIST SP 800-63B-4 tells services to require at least 15 characters for a password used without a second factor. It is a rule for services, not a measure of strength.
• No time-to-crack figure is shown: it depends on how fast an attacker can guess, which no source here fixes.