Password Entropy Calculator
Calculate password entropy in bits using Shannon's formula. Your password never leaves the browser.
Last reviewed: April 2026New to this tool? Click here for instructions
Estimated Crack Times (Brute Force)
| Attack Speed | Scenario | Estimated Time |
|---|
Measure exactly how unpredictable your password is, in bits, using Shannon's information entropy formula — all calculations run in your browser and the password never touches the network.
What This Tool Does
This calculator measures the Shannon entropy of any password you type, returning a value in bits that quantifies how many guesses an attacker would need on average to crack it through brute force. The math is straightforward: for a password of length L drawn from an alphabet of size N, entropy H equals log₂(NL), which simplifies to L × log₂(N). A 12-character password using all 95 printable ASCII characters yields 12 × log₂(95) ≈ 78.8 bits; a 4-digit PIN yields 4 × log₂(10) ≈ 13.3 bits.
The tool auto-detects which character classes you used — lowercase, uppercase, digits, symbols — and sums their pool sizes to derive N. It then reports total entropy, strength rating, and estimated crack times against three attacker profiles: a single fast GPU at one billion guesses per second, a dedicated cluster at one hundred billion per second, and a nation-state-scale attack at one trillion per second. Your password is processed entirely client-side — no character you type is uploaded, logged, stored in cookies, or persisted to disk. 🔒 You can confirm this yourself: open browser DevTools, switch to the Network tab, then type into the input. You will see zero outbound requests.
How to Use It
Three modes are available via the chips at the top: Analyze for a single password, Compare for side-by-side comparison of up to three passwords, and Reference for the entropy bracket and pool-size tables. The interface is keyboard-friendly — paste or type, and the calculation updates live with a 150ms debounce.
Analyzing a Single Password
Type or paste into the Password field. The input defaults to masked (type="password") so onlookers cannot read it; click Show/Hide to toggle. As you type, four entropy cards update with total bits, length, pool size N, and log₂(N). Below them, the strength bar shifts color from red (Very Weak, <28 bits) through orange, yellow, green, to indigo (Excellent, 100+ bits). The pool badges light up to show which character classes were detected.
Reading the Crack-Time Table
Three attacker scenarios appear below the entropy cards. The "Fast GPU (MD5)" row assumes a single consumer RTX-class GPU hashing at one billion guesses per second — realistic for unsalted MD5 or SHA-1. "Dedicated cluster" reflects a small attacker farm at one hundred billion per second. "Nation-state attack" sits at one trillion per second, modeling a well-funded adversary. These figures assume the attacker has captured the password hash and is brute-forcing offline; for online attacks against rate-limited login forms, even 50 bits is practically uncrackable.
Comparing Multiple Passwords
Switch to the Compare tab to evaluate up to three candidates side by side. Each row shows length, pool size, entropy in bits, and rating. This is the right mode when you are choosing between candidate generator outputs, deciding whether to lengthen a passphrase vs. add complexity, or auditing a password policy by entering examples that would satisfy it.
Worked Example: Three Real Passwords Compared
The clearest way to understand entropy is to walk through three passwords that look very different and see what the formula actually returns. Each calculation below uses Shannon's pure formula — the theoretical maximum assuming uniform random character selection.
Example 1: password (the literal word)
Length 8, lowercase only, so N = 26. Entropy = 8 × log₂(26) ≈ 37.6 bits. Shannon's formula would call this Fair — but in practice it is one of the top-five most-leaked passwords ever recorded and would be cracked instantly by any dictionary attack. This is the canonical example of why Shannon entropy is an upper bound, not a real-world security estimate.
Example 2: Tr0ub4dor&3 (XKCD #936 reference)
Length 11, four character classes (lowercase, uppercase, digit, symbol), so N = 26 + 26 + 10 + 32 = 94. Entropy = 11 × log₂(94) ≈ 72.1 bits — Strong by the entropy table. XKCD made this password famous to illustrate the point that despite looking complex to a human, it follows a predictable pattern: capitalize first letter, common word, leet substitutions, append symbol-digit. Real attacker dictionaries crack this in roughly three days on commodity hardware.
Example 3: correct horse battery staple (four-word Diceware)
Four words randomly selected from a 7,776-word Diceware list. Entropy = log₂(7,776⁴) ≈ 51.7 bits. Despite looking simpler than Example 2, this passphrase has actual entropy comparable to a fully random 8-character alphanumeric password — and it is dramatically easier for a human to memorize. The strength comes from the random word selection, not the words themselves. A four-word phrase you composed by intuition has far less entropy because human word choice is heavily biased.
Common Use Cases
CISO and Security Policy Review
Information security officers use entropy calculations to justify or revise corporate password policy. Showing leadership that an eight-character mixed-case password yields only ~52 bits — crackable in under an hour on a single GPU once the hash is captured — makes a stronger case for a 12-character minimum than abstract appeals to "stronger passwords." Entropy also supports defensible documentation: a written policy citing "minimum 60-bit entropy aligned with NIST 800-63B" provides clearer audit evidence than "complex passwords required."
Security Training Material
Trainers can demonstrate live why P@ssw0rd! is weak (about 56 bits theoretical, but seconds in reality due to dictionary patterns) and why correct horse battery staple is strong despite looking like four ordinary words. The visible entropy number provides immediate quantitative feedback that turns "use strong passwords" from a vague directive into a measurable target.
Comparing Password Generator Output
When evaluating password generators — built-in browser generators, 1Password, KeePass, Bitwarden, or custom scripts — paste sample output here to verify each one produces uniformly random characters at the claimed bit count. Generators with predictable patterns (e.g., always alternating letter-digit-letter) will yield lower effective entropy than their advertised length implies, though the Shannon formula alone cannot detect that — it only verifies the theoretical maximum is being approached.
Evaluating Compromise Risk on Legacy Credentials
For passwords that have been in use for years and predate modern policy, calculate entropy as a triage signal. Any account credential below 40 bits should be rotated immediately, regardless of whether the account itself shows signs of compromise. Combine with a HaveIBeenPwned check — a known-leaked password has effectively zero entropy regardless of formula output.
Edge Cases and Critical Limitations
Several caveats matter enough to overstate them rather than understate them. Shannon entropy is a useful number, but interpreting it as a security guarantee is wrong in several specific ways.
Shannon entropy assumes uniform random selection. The formula H = L × log₂(N) applies only when each character was chosen independently and uniformly from the full pool. Real human-chosen passwords have nothing like uniform character distribution: studies of leaked password corpora consistently find that the letter "e" appears far more often than expected, that "1" dominates digit positions, and that capital letters cluster at position 1. Effective entropy against an attacker who knows these biases is typically 30–60% lower than the Shannon number.
Dictionary attacks bypass entropy entirely. If your password is in a wordlist — and any password ever leaked in any breach is — the attacker tests it before brute-forcing anything. A 12-character password from the RockYou wordlist falls in microseconds regardless of its Shannon entropy. Always cross-check against HaveIBeenPwned before relying on a memorable password.
Entropy is not the only security dimension. Even a 100-bit password is useless if the service stores it in plaintext, transmits it over HTTP, has a phishing-susceptible reset flow, or lacks rate limiting on login. In threat models that include credential theft, phishing, or device compromise, multi-factor authentication (TOTP, FIDO2 hardware keys, biometrics) provides more practical security than any password length improvement. Treat high entropy as one layer in a defense-in-depth posture, not as the whole defense.
Symbol pool size assumption. This tool counts the symbol class as 32 characters (the standard ASCII printable symbol set). If your password contains Unicode characters, emoji, or extended Latin characters, the actual pool is larger than 32 for that class — entropy is conservative in those cases. Pure ASCII passwords get an accurate reading.
Behind the Scenes: From Shannon 1948 to NIST 800-63B
Claude Shannon's 1948 Foundation
The concept of information entropy comes from Claude Shannon's 1948 paper A Mathematical Theory of Communication, published in the Bell System Technical Journal. Shannon defined entropy H for a discrete random variable as the expected value of the information content, measured in bits when using base-2 logarithms. Applied to passwords, the formula assumes each character is an independent draw from a known distribution — uniform draws maximize entropy.
Shannon himself, in a separate 1951 paper estimating the entropy of printed English text, calculated that natural English averages only about 1.0 to 1.5 bits per letter, not the theoretical log₂(26) ≈ 4.7 bits a uniform draw would yield. This gap is the technical reason why a word from English text has far less entropy than the same number of random letters: human language is highly predictable, and predictability is the inverse of entropy.
zxcvbn and Realistic Strength Estimation
In 2012, Dropbox engineer Dan Wheeler released zxcvbn, a JavaScript library that estimates password strength by simulating realistic attack patterns rather than computing pure Shannon entropy. zxcvbn maintains internal dictionaries of common passwords, English words, names, dates, keyboard patterns (qwerty, asdf), and known leet substitutions (e → 3, a → @). It scores a password based on how quickly an optimized dictionary attack would find it, expressed as a guess count rather than a bit count.
The two approaches answer different questions. Shannon entropy answers "what is the maximum possible strength given the character set and length?" zxcvbn answers "what is the realistic strength given how humans actually choose passwords?" For evaluating generator output, use Shannon. For evaluating a user-typed password, use zxcvbn.
The NIST 800-63B Modernization
NIST Special Publication 800-63B Revision 3, finalized in 2017 and updated through 2024, rewrote the U.S. government's password guidance based on what the password-cracking research community had learned in the prior decade. The 2017 rewrite was led by Paul Grassi and explicitly disavowed several earlier NIST recommendations. Key changes: no forced periodic rotation (rotation causes weaker passwords as users iterate "Spring2024!" → "Summer2024!"), no forced composition rules (complexity rules produce predictable patterns), mandatory screening against known-leaked password lists, length minimum of 8 characters (15+ for high-risk accounts), and support for 64+ character passphrases without arbitrary maximum caps. The shift from complexity to length was the single biggest change; entropy gains from one extra character outweigh entropy gains from adding a symbol class.
Comparison: This Tool vs. zxcvbn vs. HaveIBeenPwned vs. 1Password
Four different tools answer four different questions about a password. Understanding which one to use when prevents misinterpretation of any single result.
| Tool | What It Measures | Best Use | Limitation |
|---|---|---|---|
| This tool (Shannon entropy) | Theoretical maximum bits from L × log₂(N) |
Verifying that a random-password generator hits its claimed bit count | Treats every character as uniform; overestimates real strength of human-chosen passwords |
| zxcvbn-based meters | Estimated guess count against an optimized dictionary attack | Realistic strength estimate for a password a human chose | Dictionary coverage is bounded; novel patterns may score higher than they should |
| HaveIBeenPwned Passwords | Whether the password appears in any of 850M+ leaked credential dumps | Catastrophic-risk screening; any hit = immediately rotate | Binary signal only; tells you nothing about non-leaked passwords' strength |
| 1Password / Bitwarden built-in strength | Hybrid of entropy + dictionary + breach-list checks | Day-to-day judgment inside a password manager workflow | Vendor-specific scoring; not standardized across managers |
The cross-references between these tools matter because each has a failure mode the others cover. Shannon entropy is fooled by predictable patterns. zxcvbn is fooled by novel patterns not in its dictionary. HaveIBeenPwned only catches passwords that have already leaked publicly. A password manager's built-in score is non-portable. Treating any single tool as authoritative is the mistake — treat each as a filter that catches a different class of weakness.
Frequently Asked Questions
What is a "good" entropy value for a password?
For online accounts with rate-limited login attempts, 80 bits of entropy is generally considered strong — that exceeds NIST 800-63B's recommended minimum and resists most realistic online attacks. For offline scenarios where an attacker has captured a password hash and can brute-force it on their own hardware, aim for 100+ bits. Anything below 60 bits is fair at best; below 40 bits is weak and falls quickly to modern GPU clusters.
Does this tool send my password anywhere?
No. The password you type stays in your browser memory and is never transmitted to a server, logged, stored in cookies, or persisted to disk. Every entropy calculation runs in JavaScript on your device. You can verify this yourself by opening browser DevTools, switching to the Network tab, and watching as you type — zero outbound requests are generated. Close the tab and the password is gone.
Why is "correct horse battery staple" considered secure?
That four-word passphrase, popularized by XKCD #936, draws from a Diceware-style list of roughly 7,776 common English words. Four randomly selected words from a 7,776-word list yield log₂(7,776⁴) ≈ 51 bits of entropy — comparable to a fully random 8-character alphanumeric password, but far easier for humans to memorize. The strength comes from random word selection, not from word familiarity; choosing words that feel meaningful to you destroys the entropy.
Is 12 characters enough for a password?
It depends entirely on the character set and on whether the characters were chosen randomly. A 12-character password drawn from the 95-printable-ASCII set with uniform randomness yields about 78 bits — strong by NIST 800-63B standards. A 12-character password where you reused a dictionary word with substitutions (like P@ssw0rd2026!) has effective entropy well under 30 bits because zxcvbn-style dictionary attacks crack it in seconds. Length matters, but randomness matters more.
What is NIST 800-63B and why does it matter?
NIST Special Publication 800-63B is the U.S. government's Digital Identity Guidelines document covering authentication and lifecycle management. Revision 3 (2017, updated through 2024) modernized password policy: it removed forced periodic rotation, removed mandatory complexity rules (uppercase/digit/symbol composition), required screening against breach databases, and emphasized length over composition. Federal agencies must comply; most major U.S. enterprises adopt it as the de facto baseline.
Should companies still force complexity rules like "one uppercase, one digit, one symbol"?
No. NIST 800-63B-3 explicitly recommends against composition rules because they produce predictable patterns (Password1!, Summer2024!) that humans default to, which dictionary attacks anticipate. Modern guidance favors a minimum length of 8 characters (15+ preferred for high-risk accounts), screening against the HaveIBeenPwned breach list, and supporting passphrases of 64+ characters without arbitrary maximum limits. Complexity rules degrade usability without improving security.
Does Shannon entropy reflect real-world password security?
Only when the password is uniformly random. Shannon entropy assumes every character was chosen independently from the full character pool with equal probability. Real human-chosen passwords cluster heavily around dictionary words, names, dates, and predictable substitutions, which means their effective entropy against an attacker using a smart dictionary is far lower than the Shannon formula suggests. Treat Shannon entropy as a theoretical upper bound, not an estimate of resistance to a real attack.
What's the difference between this tool and zxcvbn?
This tool computes pure Shannon entropy: H = L × log₂(N), where N is the size of the character pool detected in your password. It treats every character as independent and uniform. zxcvbn, released by Dropbox in 2012, does the opposite — it models realistic attacker behavior by matching against dictionaries of common passwords, leet substitutions, keyboard patterns, dates, and repeated sequences. Use Shannon entropy to evaluate a password generator's output; use zxcvbn to evaluate a human-chosen password.