Check how strong your password is instantly — see its estimated entropy in bits and estimated time to crack. 100% client-side; your password is never sent anywhere.
📂 Technology & InternetEverything runs locally in your browser — no sign-up required, and no data is ever sent anywhere.
This calculator estimates how hard your password would be to guess through brute-force random guessing, expressed as "entropy" in bits — a standard way of measuring how many possible passwords an attacker would have to try before finding yours. It looks at your password's length and which character types it mixes together (lowercase letters, uppercase letters, numbers, and symbols), since both length and variety expand the total number of possible combinations. The result is shown as a plain-language rating from Very Weak to Very Strong, along with a rough estimate of how long an offline brute-force attack would take at a fast, modern guessing speed. Nothing you type is ever sent anywhere; the entire calculation runs instantly inside your own browser using ordinary JavaScript, and the field clears the moment you leave or refresh the page. This tool measures mathematical randomness only — it does not check your password against lists of commonly used or previously leaked passwords, so a long password built from a well-known phrase can score well here while still being an easy target for a real attacker who tries common words first.
"Entropy" sounds like a physics term because it is one, borrowed by cryptography to describe the same basic idea: how much genuine unpredictability exists in a system. For a password, entropy in bits answers a concrete question — if an attacker had to guess randomly, guided by nothing but the character types you used, how many attempts would it take on average before they landed on your exact password? A password with 40 bits of entropy has roughly 2^40 (about a trillion) equally likely possibilities; one with 60 bits has roughly a billion times more than that. This calculator computes that number directly: multiply your password's length by the base-2 logarithm of the character pool size you drew from, and the result is your entropy in bits.
The character pool size is what usually surprises people. Lowercase letters alone give a pool of 26 possible characters per position. Add uppercase letters and the pool jumps to 52; add digits and it's 62; add common symbols and it climbs past 90. But here's the part that matters most in practice: adding one more character type barely moves the needle compared to adding one more character of length. Going from a 62-character pool to a 94-character pool multiplies your entropy by a modest, fixed factor — but adding a single extra character to your password multiplies the total number of possible passwords by the full pool size, every single time. That's why a long passphrase built from several unrelated words, using only lowercase letters, routinely scores higher entropy than a short eight-character password crammed with symbols.
The estimated crack time shown alongside your entropy score assumes a specific, realistic attack scenario: an offline brute-force attack, where an attacker who has somehow obtained a database of hashed passwords tries candidate passwords on their own hardware without any rate limiting from a server. Modern consumer graphics cards can attempt many billions of guesses per second against weakly-hashed passwords, which is the assumption this calculator uses to translate bits of entropy into a rough time estimate — anything from "instantly" up to "centuries," depending on your password's length and variety.
It's worth being clear about what this kind of entropy estimate does not capture. It assumes every guess is equally likely, treating your password as if it were generated by rolling dice across a fixed alphabet. Real attackers don't guess randomly — they start with dictionaries of common passwords, previously leaked password databases containing billions of real passwords people have actually used, and predictable patterns like capitalizing the first letter and appending "123!" at the end. A password like "Password123!" can score a moderate entropy number under this kind of formula while still being one of the very first guesses in any real attack, because it matches an extremely common pattern. True password strength in practice combines high mathematical entropy with genuine unpredictability — which is exactly why randomly generated passwords or passphrases (like the ones a dedicated password generator produces) tend to outperform anything a person consciously invents.
Used well, a tool like this is best treated as quick feedback while choosing or updating a password, not as a guarantee. Favor length over complexity when you have the choice, avoid reusing any password across multiple accounts, and rely on a password manager to generate and store genuinely random passwords wherever the account allows it — entropy estimates like this one are a helpful signal, but good password hygiene as a whole is what actually keeps accounts safe.
This tool estimates entropy in bits from the character types you use (lowercase, uppercase, numbers, symbols) and your password's length, using the standard formula: length × log2(pool size). More length and more character variety both increase the estimated entropy, which is then mapped to a Very Weak – Very Strong rating and an estimated offline crack time.
No. Every calculation happens instantly inside your own browser using JavaScript. The password you type is never transmitted over the network, never logged, and never saved to this site's local storage — it exists only in the input field for as long as the page stays open.
Length matters more than most people expect — each additional character multiplies the number of possible passwords, while adding one more character type (like a symbol) only multiplies it by a smaller, fixed amount. A long passphrase of unrelated words is often both stronger and easier to remember than a short, forced mix of symbols.
Not entirely. This entropy estimate assumes an attacker is guessing randomly from the character types you used — it does not check whether your password is a common word, a known leaked password, or a predictable pattern like "Password123!", all of which real attackers try first regardless of a password's raw entropy.
This page runs entirely client-side and sends nothing anywhere, but as a general safety habit it's best to avoid typing real, currently-in-use passwords into any website. Testing a similar-pattern password, or generating a brand-new one with a password manager, is the safer approach.