Password Entropy Calculator

Measure how much guessing a password actually resists, with the patterns and dictionary words that shortcut it named, and the estimate's assumptions shown.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Password Show what I'm typing

Why most password meters are wrong

The standard calculation is log2(charset size) × length. Take Tr0ub4dor&3: it has uppercase, lowercase, digits and a symbol across 11 characters, so 72 bits, so strong. Type it into almost any strength meter and it will tell you exactly that.

That figure is only correct if the password was produced by picking 11 characters uniformly at random. Nobody did that. Somebody started from a word, capitalised the first letter, swapped o for 0 and a for 4, and stuck a symbol and a digit on the end. An attacker's tools apply those exact transformations automatically, at no cost - so the real number is far lower, and the meter has told the user something reassuring and false.

So this page shows two numbers

Bits if random - the textbook figure. It is an upper bound, and it is honest only for passwords a generator produced.
Bits, realistic - an estimate that looks for the structure real passwords have: dictionary words, keyboard runs, dates and years, repeats, sequences, the leet substitutions applied to all of those, and the capital-word-plus-digits shape that composition rules produce.

Where the two disagree, the gap is the finding. A password showing 72 bits of charset entropy and 24 bits of realistic entropy is not strong; it is weak, wearing a costume.

Time-to-crack depends on something you don't control

The table shows five scenarios, and the spread between the first and last is about nine orders of magnitude. The same password that would take centuries against a properly hashed database falls in minutes if the site stored it with MD5.

That is the actual lesson, and it is uncomfortable: as a user, the thing that most determines whether your password survives a breach is a decision someone else made about storage. Length is what you control, which is why it matters more than symbol-juggling.

What it cannot see

The detection list covers the words that actually show up in breach corpora - names, animals, colours, months, teams, everyday nouns - plus a 7776-word passphrase list. It is not a complete dictionary. An unusual word will not be spotted, and a password built from personal information this page has never seen will score higher than it deserves. The estimate errs towards reporting less strength rather than more, but it cannot see everything an attacker who knows you can guess.

It never leaves the tab

This page contains no network code. The analysis runs as you type, locally, and nothing is sent - not on submit, not on blur, not in the background. You do not have to take that on trust: open your browser's network tab and watch while you type.

Frequently asked questions

Is it safe to type my real password here?

It is safe on this page, because nothing is transmitted and you can verify that in the network tab. The habit is the risk though - most strength checkers do post to a server. If in doubt, test a password with the same structure rather than the real one.

My password scores low but it's 16 characters.

Length helps only when the characters are unpredictable. Sixteen characters of dictionary word plus year is a short password with padding. The findings list will name what was recognised.

Why does a four-word passphrase beat a complex short password?

Four words chosen randomly from a 7776-word list is about 51 bits. An eight-character password with all four character classes is at most 52 bits if genuinely random, and far less in practice because it never is. The passphrase is also easier to remember, which is the part that decides whether it gets written down.

What counts as enough?

Above 60 realistic bits resists offline attack against anything but the worst storage; above 80 puts it out of reach. Below 40, assume a stolen database means a cracked password.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.