Password Entropy Calculator

Entropy in bits is the log base 2 of the total number of guesses an attacker has to try to be sure they find your password. The formula is bits = length x log2(charsetSize), so a 12-character password drawn from the full 94-character printable ASCII pool has 12 x log2(94), about 78.6 bits. Each extra bit doubles the work for a brute-force attacker, so going from 70 to 80 bits multiplies the time to crack by 1,024x. Entropy assumes the password is chosen uniformly at random from the stated character pool; anything with a pattern (a dictionary word, a date, keyboard runs) carries far less real entropy than the math suggests.

Length wins, by a wide margin. Tripling the length of a 6-character lowercase password (about 28 bits) to 18 characters of the same lowercase pool gives 84 bits, a roughly 70-trillion-fold increase in the search space. Tripling the number of character classes instead, by adding uppercase, digits, and symbols to a 6-character password, only raises the charset from 26 to 94 and gets you to about 39 bits, a one-million-fold increase. That is why every modern guideline pushes long passphrases like 'correct horse battery staple' over short, dense strings like 'P@ssw0rd!'. Length compounds because it sits in the exponent of the entropy formula; complexity only changes the base.

Different password-storage schemes give attackers wildly different speeds. A high-end GPU rig can test MD5 or NTLM at roughly 10 billion guesses per second per card, and a small cluster pushes that into trillions. Bcrypt, scrypt, and Argon2 are deliberately slow: at the work factors most apps use, attackers max out near 100 guesses per second per GPU, an 8-orders-of-magnitude difference from MD5. Online attacks against a real login form are slower still because rate limits cap them at a few requests per second per IP. Pick the speed that matches the threat: assume the worst (fast GPU on weak hash) if the database might leak, and pick bcrypt-speed if you trust the storage layer.

NIST Special Publication 800-63B sets entropy floors for memorized secrets that protect sensitive accounts. The 80-bit threshold is a practical cut-off: a password with 80 bits of true entropy survives 100 years at 10 billion offline guesses per second with a safety margin, so it stays out of reach for at least one credible attacker generation. Anything weaker can be brute-forced inside a year on commodity hardware once a hash leaks. For high-value targets such as banking, work SSO, and password manager vaults, aim for 100 or more bits; 80 is a floor, not a goal.

The whole point of an entropy check is to help you reason about secrets without exposing them. Every calculation here runs in your browser tab. The password never leaves the React component state, never gets written to localStorage, sessionStorage, the URL, or any analytics event, and never touches our server. Only the attacker-speed setting is persisted across visits, because it is a UI preference, not a secret. Closing the tab forgets the password entirely; even a memory dump of the same browser session, after you clear the field, would not recover it. If you ever see a 'password strength' tool that asks you to log in or sends the value to a backend, treat it as a phishing trap and walk away.