PassEntropy
Check your password's real strength in bits of entropy. Nothing you type here ever leaves your browser.
Password
Entropy, character pool and formula will appear here as you type.
What actually makes a password strong
Based on NIST SP 800-63B digital identity guidelines
- Length beats complexity. Length increases entropy exponentially; each extra character class only widens the pool per position.
- Skip mandatory rotation. Forced periodic changes push people toward predictable patterns (
Password1→Password2) instead of real security. - Don't force arbitrary composition rules. Requiring "one uppercase, one digit, one symbol" doesn't reliably raise entropy and mostly makes passwords harder to remember.
- Passphrases work well. Four or five random, unrelated words are usually both long and easy to recall.
How password entropy works
Claude Shannon's 1948 information entropy formula measures unpredictability in bits: E = L × log₂(R), where L is the password's length and R is the size of the character pool actually used (only the classes present are counted — lowercase 26, uppercase 26, digits 10, symbols ≈32).
| Password | Length (L) | Pool (R) | Entropy |
|---|---|---|---|
tomorrow | 8 | 26 (lowercase) | 8 × log₂(26) ≈ 37.6 bits |
Tom0rrow | 8 | 62 (lower+upper+digit) | 8 × log₂(62) ≈ 47.6 bits |
This formula assumes every character is drawn uniformly at random from the pool — it's an upper bound, not a guarantee. A dictionary word like tomorrow scores 37.6 bits here, but a real attacker guessing common words tries far fewer than 237.6 combinations, so it's actually much weaker in practice than the number suggests. Treat this tool as a measure of raw keyspace, not a dictionary-attack simulator.
Frequently asked questions
Is my password sent anywhere when I check it here?
No. Everything is computed with plain JavaScript in your browser — nothing is transmitted, logged, or stored anywhere, even locally.
What does "entropy" actually mean here?
It's a count of unpredictability in bits, from Claude Shannon's 1948 information theory. Each extra bit doubles the number of guesses a brute-force attacker needs to try on average.
Does adding symbols always make a password stronger than adding length?
No. Length increases entropy exponentially while adding a character class only widens the pool for each position — a longer password usually beats a shorter, more "complex" one. This is why NIST SP 800-63B recommends favoring length over forced composition rules.
What entropy value counts as "safe"?
There's no official cutoff, but a common rule of thumb treats 60+ bits as reasonable for most accounts and 80+ bits as strong for higher-value ones. Real-world safety also depends on whether the password is a random string or a guessable pattern/dictionary word — see the note above.