Password Entropy Calculator

How this works

Entropy starts from the character set and length, then is lowered for patterns cracking software exploits — dictionary words, keyboard runs, a word followed by numbers. The result is the effective bits, not the flattering theoretical maximum.

What the results mean

Effective entropy

Genuine unpredictability after predictable structure is subtracted. Under 35 bits is weak; 60 or more is strong against brute force.

Common problems and fixes

My password scores lower than I expected

The formula that flatters it assumes every character was chosen at random. A password you invented has structure — a word, a capital at the front, digits and a symbol at the end — and cracking tools try exactly that structure first. The lower figure is the honest one, and the fix is randomness rather than more characters of the same shape.

A passphrase scores lower than a shorter random string

Its entropy comes from the number of words and the size of the list they were drawn from, not from its character count. Four words from a 7,776-word list is about 51 bits regardless of how long it looks. That is still strong and memorable, but it does not scale with letters the way a random string does.

Two similar passwords score very differently

The estimate looks for patterns rather than measuring characters, so a small change that breaks a recognised pattern moves the number a lot. That is the point of the calculation, and it means the figure is best used to compare approaches — random against invented, longer against more complex — rather than read as a precise measurement.

Frequently asked questions

More in Security

• Password Strength CheckerSee how long a password would actually survive — and why length beats symbols.
• Password GeneratorGenerate a genuinely random password, entirely in your browser.
• Crack-Time EstimatorSee how long a password would survive a real attack — and why patterns cut it short.