Password Entropy Calculator
Estimate password entropy in bits from its length and character set.
Guided walkthrough
Guided walkthrough
Explore a simplified password search-space estimate in bits.
- Use only the public dummy text DemoOnly123!, never a real credential.
- Compare the displayed length, search-space estimate, and indicative duration. Do not enter a real password for this demonstration.
Illustrative example
The displayed bit estimate changes with length and detected character groups. A larger number does not establish real-world strength.
How to read the result
This simplified model assumes uniformly random choices from detected character groups. It does not account for predictable patterns or leaked passwords. The duration uses 10 billion guesses per second over the full modeled space; it is not a forecast of a real attack.
This is a static educational walkthrough. It does not fill fields, generate values, inspect your browser, or read storage. Use fictitious, non-secret data for practice. Never share passwords, keys, tokens, or cookie values. These explanations are not a security audit or certification.
Share this tool
Only the tool’s public link is shared. Your inputs and results stay here.
Show link to copy manually
Quick answer
Estimate password entropy in bits from its length and detected character set. The calculation assumes each character was selected independently and uniformly at random.
The page and its assets load from the site; this operation uses your entered values only in this browser and does not send them to a calculation endpoint.
How to use it
Enter a password to see a simplified entropy estimate based on its length and detected character groups. The model assumes each character was chosen uniformly at random; human-made passwords often have less entropy than this estimate suggests.
Limits
The estimate assumes independent, uniformly random characters from the detected set. It can overstate the strength of a human-chosen password.
Frequently asked questions
What does entropy in bits mean here?
It is a simplified measure of the number of possible strings under the calculator’s character-set assumption. It is not a direct measure of a human-chosen password.
Why can the result overstate password strength?
The formula assumes random independent choices; common words, sequences, dates, and reused passwords reduce practical guess resistance. It also treats every non-ASCII-letter or non-digit character as one of 33 possible symbols, so arbitrary Unicode text does not fit the model well.
Can entropy predict cracking time?
No. Time estimates also need an attack rate, hash algorithm, hardware, and other assumptions.
Why can emoji or accented text affect the estimate?
The displayed length counts JavaScript UTF-16 code units, not visible characters, so one emoji may count as two. The model recognizes ASCII letters and digits; every other character is treated as one of 33 possible symbols. Treat the estimate as rough for non-ASCII text.
Sources and references
These references document the cited standard or browser API; they do not validate the tool’s output.