Password Entropy Calculator.
Estimate password strength using Shannon entropy + zxcvbn-style pattern matching. Shows estimated crack time at consumer GPU, datacenter cluster, and nation-state attack rates. Stays in your browser; nothing is sent to a server.
Entropy is calculated locally. We do not send the password anywhere — open DevTools → Network to confirm.
How this works
- Entropy ≈ length × log₂(alphabet size). Alphabet is derived from observed character classes (lowercase / uppercase / digit / symbol / unicode).
- Common patterns (sequential keyboard runs, repeated chars, dictionary words) apply an 8-bit entropy penalty each.
- Crack-time estimates assume the attacker has the hash and can iterate at the stated rate. Real-world rates depend heavily on the hash algorithm.
Entropy report appears here
Start typing in the left pane to see the entropy in bits and estimated crack time under multiple attack rates.
Typical use cases.
Confirm a passphrase meets your organization's entropy minimum
Compare two password strategies for an audit narrative
Demonstrate password-strength differences to a non-technical stakeholder
The real fix is phishing-resistant MFA.
Microsoft data shows phishing-resistant MFA blocks >99% of identity attacks. Passwords — strong or not — are not the whole story.