Password Entropy Calculator — Measure Password Randomness

One number can lie to you — compare pool-based and true Shannon entropy, see word-based passphrase strength, and check a realistic crack-time estimate. Prefer a verdict with actionable tips? Use the Password Strength Checker, or create a fresh one with the Password Generator.

Enter Password

What is Password Entropy Calculator?

Think of entropy as the odds in your favor. It measures how unpredictable a password is, in bits — every extra bit doubles the number of guesses an attacker has to grind through. The more bits, the harder a brute-force crack becomes.

Measured in bits — every bit of entropy doubles the number of possible combinations (2^n). Adding 8 bits makes a password 256× harder to crack.

Depends on pool size and length — a 12-character password that mixes character types leaves 12 lowercase letters in the dust.

Pool size — the number of possible characters per position (26 lowercase + 26 uppercase + 10 digits + 33 symbols = 95 printable ASCII characters).

Character-based entropy — the default calculation: length × log₂(pool size). It treats every character as independently random — the right model for machine-generated passwords, and the standard for judging raw brute-force resistance.

True Shannon entropy — measured from the actual frequency of each character in your input: -Σ pᵢ log₂(pᵢ) per character. Repeated or patterned characters drag this number down, exposing predictable passwords that the naive formula misses.

Word-based entropy — for passphrases (hyphen/space-separated words): log₂(word pool) × word count. It assumes an attacker knows the passphrase structure and tries word-list combinations — the realistic, lower estimate for passphrase inputs.

Why two values? — a 4-word passphrase from the EFF wordlist (7,776 words) scores ~118 bits character-based but only ~52 bits word-based. The word-based number is what a real attacker would actually face; the character-based view overestimates passphrase strength.

Zero-Server Tool Data Guarantee

All computation happens locally in your browser. Your password is never sent to any server.

How to Use

Enter a Password

Type or paste any password or string into the input box.

Review the Metrics

Pool-based and true Shannon entropy, character composition, and the crack-time estimate update instantly as you type.

Toggle & Copy

Use the eye icon to toggle visibility and the copy button to save your password.

Common Use Cases

Compare Password Candidates

Enter two or more password options and compare their entropy bits to choose the strongest one.

Understand Pool Size Impact

See how adding uppercase letters, digits, or symbols changes the character pool and overall entropy.

Estimate Brute-Force Resistance

Use the crack time estimate to see how long an attacker running 1 billion guesses per second would need to break the password.

Spot Patterned Passwords

Compare the pool-based and true Shannon entropy numbers — a big gap reveals repeated characters or patterns that lower real-world strength.

Design Passphrase Entropy

Test random passphrase combinations to ensure they meet your security requirements.

Implementation Examples

JavaScriptEntropy Formula

function entropyBits(length, poolSize) {
    return Math.floor(length * Math.log2(poolSize));
}

// Lowercase only (pool=26), 12 chars
entropyBits(12, 26); // 56 bits

// All types (pool=95), 12 chars
entropyBits(12, 95); // 78 bits

// Passphrases: the pool is per WORD, not per character.
// 5 diceware words from the 7,776-word EFF list:
Math.floor(5 * Math.log2(7776)); // 64 bits

Entropy by Character Pool

Character Set	Pool Size	Entropy per Char	12-Char Total
Lowercase only (a-z)	26	4.7 bits	56 bits
Lowercase + uppercase	52	5.7 bits	68 bits
Letters + digits	62	5.95 bits	71 bits
All printable ASCII	95	6.6 bits	79 bits
Diceware word list	7,776	12.9 bits	155 bits (12 words)

Production Best Practices & Security

Target 60+ bits for login passwords — this provides reasonable protection against offline brute-force attacks. Why:While online attacks are limited by rate-limiting, offline attacks (where the attacker has your hashed database) can try billions of guesses per second. 60 bits makes this significantly harder.

Target 128+ bits for encryption keys — symmetric encryption (AES-256) requires this level for full security. Why:To be mathematically "unbreakable" by any current or near-future computer, a key needs enough entropy to withstand an exhaustive search of its entire keyspace.

Length is the most efficient way to increase entropy — each additional character multiplies the search space. Why:Adding a single lowercase letter to an 8-character password increases the complexity by 26 times. Complexity grows exponentially with length, but only linearly with pool size.

Character variety widens the pool — mixing lowercase, uppercase, digits, and symbols increases pool size from 26 to 95. Why:A larger pool makes each position in the password harder to guess, forcing attackers to use larger dictionaries and slower algorithms.

Don't rely on entropy alone — a predictable pattern (like "Password123!") has high calculated entropy but is easily guessed. Why:Standard entropy formulas assume every character is chosen randomly. Since humans use patterns, attackers prioritize those patterns over pure random guessing.

Compare pool vs Shannon entropy to spot patterns — if the Shannon number is much lower than the pool-based estimate, your password has repeated or patterned characters. Why:Humans pick predictable patterns; the Shannon number exposes the predictability that the naive formula misses.

Use a password manager — it generates truly random passwords that maximize entropy for their length. Why:Computers are much better at randomness than humans. A password manager ensures there are no patterns or biases for an attacker to exploit.

Passphrases need word-based evaluation — entering a multi-word passphrase triggers word-based entropy automatically in the Passphrase Strength section. The realistic strength is often much lower than the character-based estimate suggests. Always check both values.

Frequently Asked Questions

Entropy measures how unpredictable your password is, expressed in bits. Think of it as the number of guesses an attacker would need on average to crack it — each bit of entropy doubles the difficulty.

A password with 40 bits can be cracked in roughly a trillion tries (easy for a GPU). With 80 bits, it requires 2^80 guesses — computationally infeasible with current technology. Entropy depends on two things: password length and the number of possible characters per position. A 12-character password using only lowercase (≈56 bits) actually edges out an 8-character password drawn from the full printable ASCII set (≈53 bits) — length is that powerful. Type a password above to see its bits update in real time.

Pool size is the number of possible characters for each position in your password. The larger the pool, the harder each character is to guess.

Lowercase-only passwords draw from a pool of 26 characters — each position has 26 possibilities. Mixed-case adds 26 more (52 total). Adding digits brings it to 62, and including all printable ASCII symbols pushes it to 95.

Going from a 26-character pool to a 95-character pool at the same length adds roughly 1.9 bits of entropy per character — and that compounds across your entire password.

Pool-based entropy is length × log₂(pool size) — it assumes every character was chosen randomly and independently. This is accurate for machine-generated passwords.

True Shannon entropy measures the actual information content of your input using character frequencies: -Σ pᵢ log₂(pᵢ) per character. If your password repeats characters or follows obvious patterns, this number drops.

Example: aaaaaaaaa9 is 10 characters from a pool of 36 (pool-based ≈ 52 bits), but Shannon sees one character repeated 9 times and scores only ~0.5 bits per character. The gap between the two numbers is exactly the predictability you are leaving in.

Crack time estimates use the entropy formula (2^entropy ÷ guesses_per_second). The tool shows the estimate at 1 billion guesses per second — roughly what a single modern GPU can achieve with fast hash functions like MD5.

Real-world attackers with specialized hardware (ASICs, multi-GPU rigs) can go faster, while slow hash functions like Bcrypt or Argon2 make the estimate wildly pessimistic because those algorithms resist exactly this kind of attack.

Treat the number as a useful relative comparison rather than an absolute prediction. Want pattern warnings on top of the number? The Password Strength Checker flags repeated characters, dictionary words, and keyboard patterns explicitly.

For most accounts, 60-80 bits is strong. For password manager master passwords, aim for 80-100 bits. For encryption keys, use 128+ bits.

A 5-word passphrase from the EFF wordlist provides ~65 bits; a 6-word passphrase gives ~78 bits. Each additional bit doubles the attacker's work — 80 bits requires 2^80 guesses, which is computationally infeasible today.

The calculator shows your exact entropy so you can adjust length and character sets to meet your target. Short on ideas? Let the Password Generator or the Passphrase Generator craft one for you.

When you enter a multi-word passphrase (like true-xray-lime-quiet), the calculator detects it and shows two estimates.

Character-based entropy treats your input as random characters — 4 common words with hyphens score ~118 bits. Word-based entropy assumes an attacker knows the passphrase structure and tries word-list combinations — giving ~52 bits (using the EFF 7,776-word list).

Word-based is the realistic model for passphrases, which is why our Passphrase Generator uses it.