Check a password's entropy in bits and its average brute-force crack time at a chosen guess rate, or generate a password from a reproducible seed.
പുതുക്കിയത് പരിശോധിച്ച ഉദാഹരണങ്ങൾ: 6
This password has 11 characters from a pool of 95, about 72.3 bits of entropy. An attacker making 10,000,000,000 guesses per second needs 9,010 years on average to find it by brute force.
| Attacker | Guesses per second | Average time |
|---|---|---|
| Online, rate-limited | 10 | 9.01 × 10¹² years |
| Online, no rate limit | 1,000 | 9.01 × 10¹⁰ years |
| Offline, slow hash | 10,000 | 9.01 × 10⁹ years |
| Offline, fast hash | 10,000,000,000 | 9,010 years |
| Offline, large cluster | 1,000,000,000,000 | 90.1 years |
On average an exhaustive search finds the password halfway through the space.
About 9,010 years.
Entropy counts how many guesses a randomly chosen password could take: H = L × log2 N bits, where L is the length and N the size of the character pool (26 lowercase, 26 uppercase, 10 digits and 33 symbols including space). A brute-force search finds the password after N^L ÷ 2 guesses on average, so the crack time is that number divided by the attacker's guesses per second.
The default, Tr0ub4dor&3 from the xkcd comic 936, draws on all 95 printable ASCII characters across 11 positions, which gives 72.3 bits; at 10 billion guesses per second an exhaustive search would average 9,010 years.
That figure is an upper bound, because it assumes every character was picked at random. Tr0ub4dor&3 is a dictionary word with common substitutions, which the comic puts at about 28 bits. Generated passwords come from xoshiro256** and a 64-bit seed, so they hold at most 64 bits whatever their length.
പരിശോധനയുടെ ഉറവിടം: Python 3.8: 11 * math.log2(95) = 72.2684…; Decimal(95)**11 / 2 / Decimal('1e10') = 284400046138.22998… s
പരിശോധനയുടെ ഉറവിടം: Python 3.8: 8 * math.log2(26) = 37.6035…; 26**8 // 2 = 104413532288; / 1e10 = 10.4414 s
പരിശോധനയുടെ ഉറവിടം: Python 3.8: math.log2(26) = 4.7004; 26 / 2 = 13 guesses; 13 / 10 = 1.3 s
പരിശോധനയുടെ ഉറവിടം: Independent Python 3.8 port of splitmix64.c and xoshiro256starstar.c with the same rejection rule; 16 * math.log2(94) = 104.87
NIST SP 800-63B-4 (2025) requires at least 15 characters for a password used on its own and at least 8 when it is one factor of a multi-factor login, and services should accept passwords of at least 64 characters. It forbids composition rules such as forced symbols and periodic forced changes, and instead requires checking each new password against a blocklist of common and breached passwords.
It depends on the pool, the length and the attacker's speed. A random 8-letter lowercase password has 26^8 ≈ 2.1 × 10^11 combinations and falls in about 10 seconds on average at 10 billion guesses per second, a fast offline attack on a leaked hash. A random 16-character password from 94 printable symbols would take about 5.9 × 10^13 years at the same speed.
Password entropy is the base-2 logarithm of the number of equally likely passwords the choosing method could produce, in bits; each extra bit doubles the guesses needed. A random password of length L from N symbols has L × log2 N bits, so 8 lowercase letters give 37.6 bits. It rates how the password was chosen, not how it looks, which is why human-picked words score far lower.
Usually, if the words are chosen at random. Four words drawn from the EFF's 7,776-word dice list give 4 × log2 7,776 ≈ 51.7 bits, and six give 77.5 bits, more than a random 11-character password from all 95 printable characters (72.3 bits), while being easier to type and remember. Words a person picks, or a known quote, are far weaker.
Only with a secret, random seed. The generator is reproducible by design: xoshiro256** seeded with a 64-bit number, so anyone who knows the seed and settings gets the same password, and it never holds more than 64 bits of entropy. For everyday accounts, a password manager's generator is the better choice because it draws from the operating system's cryptographic random source.
കൃത്യത നിങ്ങളുടെ ഇൻപുട്ടുകളെയും രീതിയുടെ അനുമാനങ്ങളെയും ആശ്രയിച്ചിരിക്കുന്നു. ദശാംശ ഗണിതം 50 സാർഥക അക്കങ്ങൾ ഉപയോഗിക്കുന്നു. എന്നാൽ അനുമാനക്കണക്കുകൾ, സംഖ്യാത്മക രീതികൾ, ഉറവിട ഡാറ്റ എന്നിവയ്ക്ക് കൃത്യത കുറവാകാം; പ്രദർശിപ്പിക്കുന്ന മൂല്യം റൗണ്ട് ചെയ്യുന്നത് ഈ പരിമിതികൾ നീക്കില്ല. സ്വതന്ത്ര ഉറവിടങ്ങളിലെ പരിഹാരങ്ങളുമായി പരിശോധിച്ച ഉദാഹരണങ്ങൾ: 6. ഉദാഹരണത്തിന്, “Tr0ub4dor&3” എന്നത് Python 3.8: 11 * math.log2(95) = 72.2684…; Decimal(95)**11 / 2 / Decimal('1e10') = 284400046138.22998… s ഉപയോഗിച്ച് പരിശോധിക്കുന്നു.
NIST SP 800-63B, Digital Identity Guidelines: Authentication — memorized secrets and rate limiting; Blackman & Vigna, Scrambled linear pseudorandom number generators, ACM TOMS 47(4), 2021 — xoshiro256** reference code.
ഈ കാൽക്കുലേറ്ററിൽ സ്വതന്ത്ര ആധാരങ്ങളിൽ നിന്ന് ഉത്തരങ്ങൾ ലഭിച്ച 6 പരിഹരിച്ച ഉദാഹരണങ്ങളുണ്ട്. ഇവ പരിശോധനാസമുച്ചയത്തിൽ പ്രവർത്തിക്കുന്നു; നിങ്ങൾക്ക് ഇവിടെയും പ്രവർത്തിപ്പിക്കാം.
Generate MD5, SHA-1, SHA-256, SHA-512 and CRC-32 hashes of any text, check them against a published checksum, and see the avalanche effect.
Generate reproducible UUID v4 and v7 values from a seed, or validate any UUID or GUID and decode its version, variant and embedded timestamp.
Operation counts and running times for O(1), O(log n), O(n), O(n log n), O(n²), O(n³), O(2ⁿ) and O(n!) at your input size, on a log-scale chart.