Password Entropy Calculator

Two ways of measuring the same quantity. Characters treats a secret as a string drawn from whichever character classes appear in it. Words treats it as a sequence of words drawn from a list, which is how a diceware-style passphrase is generated. Switch between them with the first control.

Nothing you type leaves this page. There is no network call in the code, no storage, no analytics, and no server involved after the page has loaded — the calculation happens in your browser and the value is discarded when you close the tab. You can confirm that by reading the page source, which is the only assurance of this kind worth having.

A list size of 7776 is what five six-sided dice produce, which is why so many word lists are that length; 1296 is four dice and 2048 is eleven bits per word exactly. Any list works — put in the size of the one you are actually using.

What the number is

Entropy here is a property of the procedure that produced the secret, not of the string sitting in the box. Both modes compute the same thing:

bits = length × log2(pool size)

For characters, the pool is the count of distinct symbols the generator could have chosen from, inferred from which classes appear: lower case contributes 26, upper case 26, digits 10, ASCII punctuation and symbols 32, the space character 1. Any character outside printable ASCII is counted only as itself, one per distinct character, because there is no honest way to guess what alphabet an attacker would assume for the rest of Unicode. That makes the figure a floor whenever such characters are present.

For words, the pool is the size of the list, and the length is the number of words. This mode is the more meaningful of the two, because a diceware-style passphrase is one of the few secrets whose generation procedure is actually known: each word really was drawn uniformly at random, so the arithmetic describes reality rather than assuming it.

What the number is not

It is not a measurement of a password you invented. If a person chose the string, the calculation above is an upper bound and usually a wildly optimistic one. It assumes every position was filled independently and uniformly. Human choices are neither: they cluster on words, names, dates, keyboard runs, and substitutions that guessing software has known about for decades. A memorable password can be assigned a high figure here and still fall in a trivial number of guesses, because the attacker is not sampling from the pool the formula assumes — they are sampling from the far smaller set of things people actually pick.

It is not a time. This tool deliberately does not display “would take N years to crack”, and the omission is the point. Converting bits into a duration requires a guess rate, and a guess rate requires assuming the attacker’s hardware, their budget, how many machines they run in parallel, and above all which algorithm protects the stored secret — the same password behind a modern memory-hard hash and behind a single unsalted digest differs by many orders of magnitude in resistance. None of those values is knowable from what you typed. Any number of years shown next to this figure would be invented, and an invented number that looks precise is worse than no number, because people act on it.

It is not affected by what the site does with it. Entropy describes the secret. Rate limiting, lockout, multi-factor requirements, breach-list checking and the choice of password hash all change the outcome far more than a few extra bits do, and none of them is visible from here.

Comparisons within a mode are the honest use. Whether 60 bits is “enough” depends entirely on the threat you are defending against, which this page knows nothing about. What the figure does support is relative reasoning: adding one word to a passphrase adds log2(list size) bits regardless of length, while adding one character to a password adds log2(pool size), and seeing those two side by side tends to settle the argument about which approach scales better.

The self-test

The line under the panel reports a self-test that runs on load, checking the calculation against hand-worked cases with known answers — eight characters of lower case at log2(26) each, four words from a 2048-word list giving exactly 44 bits, an all-space string giving zero, and several others. If any case fails, the panel says so instead of showing a figure. A calculator that is quietly wrong is worse than no calculator, and this one has no way of knowing it is wrong unless it checks.