Entropy Calculator
Password & SecurityProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
The Entropy Calculator analyzes your password using three complementary methods: the zxcvbn pattern-matching engine, pool-based theoretical entropy, and Shannon information entropy. Together they give a complete picture of how resistant your password is to different types of attacks.
How It Works
- Actual entropy (zxcvbn): Recognizes dictionary words, keyboard patterns, repeated characters, dates, and common substitutions (like @ for a). Gives a realistic estimate of how many guesses an attacker would actually need.
- Theoretical entropy: Calculates the maximum possible entropy assuming every character is randomly chosen from the detected character pool (lowercase, uppercase, digits, symbols).
- Shannon entropy: Measures the actual information content based on character frequency distribution. Reveals patterns like repeated characters that theoretical entropy misses.
- Attack scenarios: Shows estimated crack time under four different attack speeds — from throttled online attempts to GPU cluster brute-force.
Understanding the Three Entropy Types
Each entropy type reveals a different aspect of password strength. Theoretical entropy tells you the maximum possible strength for a given length and character set. Actual entropy (zxcvbn) tells you how strong the password really is against smart attacks. Shannon entropy tells you how much unique information each character contributes.
The gap between theoretical and actual entropy is especially revealing. A password like "Password1!" has high theoretical entropy (mixed character types, 10 characters) but very low actual entropy because it is one of the most commonly used passwords. The efficiency percentage in the tool shows this gap at a glance.
Entropy Benchmarks
- < 40 bits: Weak — crackable in seconds to minutes
- 40–60 bits: Fair — crackable in hours to days
- 60–80 bits: Strong — crackable in years to centuries
- 80+ bits: Very strong — effectively uncrackable with current technology
How to Create a Strong Password
- Use 12+ characters — length is the single most important factor for entropy
- Mix character types — combine uppercase, lowercase, digits, and symbols
- Avoid common patterns — no dictionary words, keyboard walks (qwerty), or personal info
- Consider passphrases — 5–6 random words from a large wordlist can achieve 65–80 bits of entropy while being easy to remember
- Use unique passwords — every account should have a different password; a password manager makes this practical
Frequently Asked Questions
How much entropy do I need for a secure password?
For most online accounts, aim for at least 60 bits of entropy. For high-value accounts (email, banking, password manager master key), target 80+ bits. A 16-character password with mixed character types typically achieves 80–100 bits of theoretical entropy.
What is the difference between theoretical and actual entropy?
Theoretical entropy assumes every character is randomly chosen from the character pool. Actual entropy (measured by zxcvbn) accounts for patterns like dictionary words, keyboard walks, and repetitions that attackers exploit. A password like "Password1!" has high theoretical entropy but very low actual entropy because it is one of the most commonly used passwords.
What is Shannon entropy?
Shannon entropy measures the actual information content of a string based on how frequently each character appears. A password like "aaaa" has zero Shannon entropy because it contains only one unique character repeated four times, while a random string has high Shannon entropy. It complements pool-based entropy by revealing character distribution patterns.
How accurate are the crack time estimates?
The estimates assume an attacker can try passwords at various speeds — from 100 guesses per second (online with rate limiting) to 1 trillion guesses per second (GPU cluster). Real-world attacks face many obstacles like rate limiting, account lockouts, and key stretching (bcrypt, Argon2) that dramatically increase security beyond these estimates.
Is my password sent to a server?
No. All computation happens entirely in your browser using JavaScript. Your password is never transmitted to any server, stored, or logged. This tool runs 100% client-side.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.