Password Strength Calculator

Length multiplies the total combination space by the full charset size for every additional character, which is an exponential effect, while adding a character type only widens the charset size itself, a comparatively smaller one-time boost. A 16-character password using only lowercase letters generally has more entropy than a 10-character password using all four character types, because length compounds while charset variety does not.

The calculator takes the total possible combinations (charset size raised to the password length) and divides by twice an assumed 10 billion guesses per second, since an attacker searching randomly finds the correct password after checking half the space on average. This rate models a well-resourced offline attack against a fast, unsalted hash -- real-world cracking speed varies enormously depending on the hashing algorithm actually protecting the password.

The calculator falls back to a charset size of 26 (equivalent to lowercase-only) rather than reporting zero possible combinations, since a charset size of zero would make entropy mathematically undefined. In practice, disabling every character type is not a usable password policy -- the fallback exists to keep the calculator's math well-defined, not to suggest that configuration is a realistic choice.

No -- the entropy and strength ratings here measure only length and character variety, so a long, high-entropy password built from a predictable pattern (like a common phrase with characters substituted for letters) can still be far weaker in practice than its calculated entropy suggests, because real attackers try dictionary words and known patterns before brute-forcing randomly.