Security Tools Calculator

Entropy is length multiplied by log2(charset size), so length is a linear multiplier on the bit count while charset size only enters through a logarithm -- doubling the length always doubles entropy, but doubling the charset size (say from 47 to 94 characters) only adds about 1 extra bit per character. A long password built from a smaller character set can easily out-entropy a short one stuffed with every symbol, which is the reasoning behind passphrase-style password advice.

Online attacks are limited by how fast the target system will accept login attempts -- a well-configured server rate-limits guesses to roughly 100 per second or fewer. Offline attacks happen after an attacker has already stolen a password database; with no server to rate-limit them, they can run guesses at whatever speed their hardware allows, which for a fast unsalted hash on modern GPU clusters can reach into the trillions of guesses per second -- many orders of magnitude faster than any online login form would ever permit.

Being slow is the entire point for password hashing, not a weakness -- SHA-256 is deliberately fast because it was designed for data integrity checks, which makes it a poor fit for passwords since a fast hash lets an offline attacker try billions of guesses per second. bcrypt and Argon2 are intentionally slow (and Argon2 also memory-hard) specifically to throttle an attacker's guess rate down to something much closer to an online attack's speed, even after a database breach.

Not proportionally -- each additional character class (lowercase, uppercase, numbers, symbols) only multiplies the charset size, and because entropy scales with log2 of that size, each successive class adds a shrinking number of bits rather than a fixed amount. Going from letters only to letters+numbers helps meaningfully; adding symbols on top helps less in absolute bit terms than going from length 8 to length 16 would.