Password Entropy & Time-to-crack Estimator
What is Password Entropy?
Password entropy is a measurement of how unpredictable and random a password is. It's expressed in bits, where each additional bit doubles the number of possible combinations. Higher entropy means a password is more resistant to guessing and brute-force attacks.
- Measured in Bits: Each bit doubles possible combinations
- Randomness Factor: More random = higher entropy = stronger
- Attack Resistance: Predicts time needed to crack password
- Security Metric: Industry-standard password strength measurement
- Private: Passwords are analyzed locally and never uploaded
Why check entropy in your browser?
Typing a real password into a web form to "check its strength" is itself a security risk if that form logs input or sends it anywhere. This estimator calculates entropy and crack-time locally in JavaScript — the password you test is never transmitted, so you can safely check the actual password you plan to use, not a stand-in.
What gets analyzed
What gets analyzed
- Bits of entropy: A single, comparable number representing password strength
- Crack-time estimate: How long different attack speeds would take against this password
- Pattern detection: Flags common passwords, dictionary words, and personal-info patterns that reduce real-world security
How to Use
- Enter or paste the password you want to analyze
- View real-time entropy calculation and strength rating
- Check estimated crack time under different attack scenarios
- Review suggestions for improving password security
- Verify the password meets your security requirements
Entropy & Security Glossary
- Entropy
- A measure of randomness or unpredictability in a password, expressed in bits.
- Bits of Entropy
- Each bit represents a doubling of password complexity. 80+ bits is considered strong.
- Brute Force
- Systematically trying all possible password combinations until finding the correct one.
- Attack Vector
- A method or pathway used by attackers to gain unauthorized access to a system.
- Character Space
- The total number of possible characters available for password creation.
- Guesses Per Second
- The rate at which an attacker can attempt password combinations.
- Common Password
- A password widely known to be overused and easily guessed, such as "password123" or "qwerty".
- Password Policy
- Rules defining minimum requirements for acceptable passwords in a system.
Sources
- NIST SP 800-63B — Digital Identity Guidelines — Federal authentication/password strength guidance