The formula
A secret chosen uniformly at random from S possibilities has log2(S) bits of entropy. An attacker who tries them in some order finds it, on average, halfway through: after S/2 guesses. At r guesses per second that takes S/(2r) seconds. For random characters, S = NL (set size to the power of the length); for random words, S = Wk (list size to the power of the word count).
This only holds for secrets that really were chosen at random. A password a person made up has far fewer likely possibilities than its length suggests, because attackers try likely choices first. For those, use the strength checker, which estimates instead.
The rates are assumptions
| Scenario | Rate (assumed) | Situation |
|---|---|---|
| Online, rate-limited | 100 guesses per hour | a login form that slows down or locks out repeated failures |
| Offline, slow hash | 10,000 guesses per second | a stolen database hashed with a deliberately slow, salted scheme (bcrypt class) |
| Offline, fast hash | 100 billion guesses per second | a stolen database hashed with a fast unsalted hash (MD5, SHA-1 or NTLM class) on a high-end GPU rig |
Real rates depend on the attacker's hardware, how the service stored the password and whether it limits attempts. The three above are rough reference points spanning that range, from a login form that locks after repeated failures to a GPU rig working on a leaked, poorly hashed database. How long it takes to crack a password explains where they come from and why the spread is so wide.
Common cases
| Secret | Bits | Online, 100/hour | Slow hash, 104/s | Fast hash, 1011/s |
|---|---|---|---|---|
| 4-digit PIN | 13.3 | 2.1 days | less than a second | less than a second |
| 6-digit PIN | 19.9 | 208 days | 50 seconds | less than a second |
| 8 random lowercase letters | 37.6 | 119 thousand years | 121 days | 1 second |
| 8 random printable characters | 52.4 | 3.5 billion years | 9.7 thousand years | 8.5 hours |
| 12 random letters and digits | 71.5 | about 1015 years | 5.1 billion years | 511 years |
| 3 random EFF words | 38.8 | 268 thousand years | 272 days | 2.4 seconds |
| 4 random EFF words | 51.7 | 2.1 billion years | 5.8 thousand years | 5.1 hours |
| 5 random EFF words | 64.6 | 16 trillion years | 45 million years | 4.5 years |
| 6 random EFF words | 77.5 | about 1017 years | 350 billion years | 35 thousand years |
| 7 random EFF words | 90.5 | about 1020 years | about 1015 years | 272 million years |
| 16 random printable characters | 104.9 | about 1025 years | about 1019 years | 5.9 trillion years |
| 20 random printable characters | 131.1 | about 1033 years | about 1027 years | about 1020 years |