Free · Private · Client-side

Password Entropy Calculator

Analyze password strength through entropy calculation, character set analysis, and time-to-crack estimates — computed entirely in your browser. Get recommendations for stronger passwords.

Generated values never leave this device.

Enter password to analyze

Your password is analyzed locally in your browser and never sent to any server.

Type a password above to see its estimated entropy, strength rating, and crack time.

Just want a quick check? →

Test common passwords

Click on these common passwords to see how weak they really are:

Understanding password entropy

What is entropy?

Password entropy measures the unpredictability of a password. It's calculated as log₂(charset size)^length and expressed in bits. Higher entropy means stronger security.

Time to crack

Estimates assume an attacker renting serious hardware can try a trillion passwords per second. Real-world factors like rate limiting, salting, and key stretching significantly increase security.

Character sets

• Lowercase only: 26 characters

• + Uppercase: 52 characters

• + Numbers: 62 characters

• + Symbols: 94+ characters

Strength guidelines

• <30 bits: Very weak

• 30-50 bits: Weak

• 50-70 bits: Fair

• 70-90 bits: Good

• 90+ bits: Strong/Very strong

Frequently asked questions

▶How accurate are the time-to-crack estimates?

The estimates assume optimal conditions for an attacker and perfect knowledge of your password's character set. Real-world attacks face many obstacles like rate limiting, account lockouts, and proper password hashing that dramatically increase the time required.

▶Is a longer password always better than a complex one?

Generally yes! Length has exponential impact on entropy, while character complexity has linear impact. A 20-character lowercase password often has more entropy than a 12-character mixed-case password with symbols. However, the best approach combines both length and complexity.

▶What about dictionary words and patterns?

This calculator assumes purely random character selection. Dictionary words, patterns, and predictable substitutions (like @ for a) significantly reduce actual security. Use random generation or high-entropy passphrases for critical accounts.

▶How much entropy do I need?

For most online accounts: 64+ bits. For high-security accounts: 80+ bits. For master passwords and encryption keys: 128+ bits. Remember that two-factor authentication provides additional security layers beyond just password strength.

Privacy & security

All password analysis happens locally in your browser using JavaScript. Your passwords are never transmitted to any server or stored anywhere. This calculator provides theoretical entropy measurements — consider using a password manager for generating and storing truly secure passwords.