Entropy, not a colour-coded guess
Measure a password's entropy in bits and see roughly how long a fast offline attack would take. Nothing is transmitted.
Most strength meters reward superficial tricks — a capital letter, a digit on the end — that attackers have accounted for since forever. Entropy measures something real: how many guesses the password actually costs.
The calculation is length multiplied by the bits per character from your alphabet. Length dominates completely, which is why a long lowercase passphrase beats a short mangled word.
What this calculator shows
- Entropy in bits and a plain verdict
- Estimated time to crack under a fast offline attack
- The character pool size the password draws from
What to keep in mind
- Assumes 100 billion guesses per second, typical of offline GPU cracking of a weak hash.
- Entropy assumes randomness — a dictionary word scores well here but falls in seconds to a real dictionary attack.
FAQs
How many bits of entropy do I need?
Sixty is a reasonable floor for ordinary accounts and eighty or more for email and banking. Below fifty is genuinely at risk.
Is my password sent anywhere?
No. The calculation runs entirely in your browser and nothing leaves the page.
Why does the score overrate dictionary words?
Because the formula only sees length and character variety. Real attackers try words, names and common substitutions first, so 'P@ssw0rd123' falls almost immediately.
Are passphrases better?
Usually, yes. Four random words give around 50–60 bits and are far easier to remember than a mangled short password of similar strength.
Worked example
The famous example
Input: Tr0ub4dor&3
Output: About 72 bits by the formula
Note: The number flatters it. Because it is a dictionary word with predictable substitutions, real cracking software finds it far faster than the entropy suggests.