Password Entropy Calculator

Password entropy is a measure of how unpredictable a password is, expressed in bits. It estimates the size of the search space an attacker must cover to guess it. More bits means more possible combinations and a harder password to crack. Entropy matters because it is the single most meaningful, math-based signal of real password strength — far more honest than a red/yellow/green meter that hides its scoring. A password with 40 bits has about a trillion possibilities; one with 80 bits has about a sextillion.

It is safe only if the tool runs entirely in your browser and sends nothing to a server. This calculator is zero-knowledge: your password is processed in local JavaScript memory and is never uploaded, stored, logged, or cached. You can even disconnect from the internet after the page loads and it keeps working. Avoid any 'entropy checker' that makes network requests while you type, because that could leak your password.

It uses the Shannon entropy approximation: Entropy = L × log₂(R), where L is the password length and R is the size of the character pool it draws from (26 lowercase + 26 uppercase + 10 digits + ~33 symbols, plus extended-ASCII and Unicode ranges when present). For example, a 12-character password using all four basic classes has about 12 × log₂(95) ≈ 78.5 bits of entropy. The tool also computes the total combinations (R^L) and estimates crack time for several attack speeds.

As a rule of thumb: under 40 bits is weak, 40–60 is fair, 60–80 is good, 80–100 is strong, 100+ is excellent, and 120+ is enterprise grade. For most personal accounts, aim for at least 60–80 bits. For important or admin accounts, target 80+ bits. A 4-word Diceware passphrase gives roughly 51.6 bits, and 6 words gives about 77 bits — both memorable and strong.

No. The password exists only in your browser's volatile memory while the page is open. The tool uses no localStorage, no sessionStorage, no IndexedDB, no cookies, and makes no fetch, beacon, WebSocket, or analytics calls. Clearing the field (or closing the tab) releases the value immediately. Your password never leaves the device.

Shannon entropy, named after Claude Shannon, quantifies the average unpredictability of information. For passwords we approximate it as L × log₂(R): length times the log-base-2 of the character-pool size. This assumes each character is chosen independently and uniformly from the pool. It is an estimate, not a guarantee, but it is the standard, transparent way to reason about password strength.

Typical strength meters apply opaque, proprietary scoring that often rewards symbols and punctuation more than math justifies, and may penalize long passphrases. Entropy is a single, explainable number derived from length and pool size. This calculator shows the formula, the exact bits, and the assumptions, so you can see precisely why a password scores the way it does.

One bit of entropy doubles the number of possible passwords. Two bits quadruples it, three bits octuples it, and so on. So 64 bits means roughly 2^64 (about 18 quintillion) possibilities. Each additional bit makes a brute-force search twice as hard. Entropy in bits is the cleanest way to compare passwords of different lengths and character sets.

Use Entropy = L × log₂(R). Count the distinct character types in your password to get R (lowercase 26, uppercase 26, digits 10, symbols ~33), multiply those that appear to size the pool, then multiply by the length L. Example: an 8-character password with lower + upper + digit + symbol uses R = 95, so entropy ≈ 8 × log₂(95) ≈ 52.4 bits. The calculator does this instantly and also handles Unicode and passphrases.

A larger pool means more entropy per character. Using only digits gives R = 10. Adding lowercase raises it to 36, adding uppercase to 62, and adding symbols to about 95. Extended ASCII and Unicode push R much higher. Whenever possible, include all four basic classes (R ≈ 95) so each character contributes ~6.57 bits instead of ~3.32 (digits only) or ~5.17 (letters only).

Length usually matters more. Entropy grows linearly with length but only logarithmically with pool size. Going from a 10-character to a 20-character password doubles the bits, while maxing out character sets adds a smaller fixed bump. The best strategy is a long password (or passphrase) that also uses a reasonably large character pool.

Diceware builds a passphrase by randomly selecting words from a word list (traditionally with dice). Each word from a 7,776-word list contributes about log₂(7776) ≈ 12.9 bits. A 4-word passphrase is ~51.6 bits and a 6-word passphrase ~77.4 bits. This calculator detects multiple words and reports per-word and total entropy, then shows the equivalent random-character length needed to match.

At equal entropy, they are equally secure. The advantage of a passphrase is memorability: a 5-word Diceware phrase (~64 bits) is far easier to remember than a random 14-character string of the same strength. The catch is that the words must be chosen randomly — a passphrase built from a song lyric or a famous quote has much less entropy than it appears to.

Crack time equals the search space (R^L) divided by an attacker's guess rate. A consumer GPU testing ~10 billion hashes per second can exhaust a 50-bit space in minutes, while a 70-bit space takes centuries. This calculator estimates time for a consumer GPU, gaming GPU, enterprise cluster, offline ASIC attack, and a rate-limited online attack, assuming a fast hash. Slow hashes (bcrypt, scrypt, Argon2) are orders of magnitude slower to crack.

Humans are biased: we use names, dates, and predictable substitutions like 'p@ssw0rd'. Attackers know these patterns and test them first, which collapses real entropy well below the theoretical maximum. A password generated by a password manager or rolled from Diceware has no such bias, so its measured entropy is closer to its true strength.

Symbols help, but modestly. Adding the symbol class to a letters-only password raises R from 52 to about 85, adding roughly 0.7 bits per character. The bigger win is length. Appending a single '!' to a weak base word barely changes crack time because attackers try that suffix automatically. Use symbols as part of a long, random password rather than as a magic strength token.

Not by itself. Entropy measures theoretical unpredictability, not whether a specific password appears in a breach list. This tool flags whether your input matches common breached passwords and patterns, but you should also check credentials against a service like Have I Been Pwned. High entropy plus absence from breach lists is the goal.

They serve different needs. A password manager generates and stores credentials; this calculator explains the math behind strength so you can evaluate any password, policy, or generator. It pairs well with the FreeDeskTools Secure Password Generator and Cryptographic Hash Generator for a privacy-first security workflow.

Yes. After the page loads, all calculation logic is already in your browser. You can disable Wi-Fi or unplug the network and the calculator still works, because it performs no network requests. This makes it safe to analyze sensitive credentials without any exposure.

The L × log₂(R) formula assumes each character is drawn independently and uniformly from the detected pool. Real passwords often deviate (repeats, patterns, biased choices), so the reported entropy is an upper bound on true strength. The calculator surfaces those deviations through its pattern analysis and recommendations so you get a realistic picture, not just a theoretical maximum.