Password Entropy Checker

Analyze password strength with estimated entropy bits and practical suggestions. Paste a password and click Run.

  • Runs entirely in your browser
  • No data stored or sent to a server
  • Free forever — no signup
  • Instant conversion

Input and Output

Use the interactive encoder and decoder on this page to process your text.

Learn more about password entropy

Password Entropy and Strength Estimates

Password Entropy

What Is Entropy?

Entropy measures password unpredictability in bits. Higher entropy means more possible combinations and longer brute-force time. This tool estimates entropy from length and character set diversity — a heuristic, not a guarantee against dictionary attacks.

Rough Entropy Guidelines

  • Below 40 bits — weak; crackable with modest effort
  • 40–60 bits — moderate; OK for low-risk accounts with rate limiting
  • 60–80 bits — strong for most web applications
  • 80+ bits — very strong; suitable for secrets and master passwords

Common Mistakes

  • Trusting high entropy on dictionary words with substitutions (P@ssw0rd!)
  • Long passwords with low character diversity (only lowercase letters)
  • Reusing high-entropy passwords across sites — one breach compromises all

Developer Tips

  • Prefer length over complexity — passphrases beat short complex passwords
  • Enforce minimum length server-side; entropy estimates are advisory only
  • Use a password manager to generate and store truly random secrets

Frequently asked questions

Does this check against known breached passwords?

No. This estimates entropy from character set and length only. Dictionary and breach-list checks require separate validation.

Why does my complex password score low?

Short passwords with symbols still have limited search space. Length contributes more entropy than symbol variety alone.

Is entropy the same as BCrypt strength?

No. Entropy measures input randomness. BCrypt adds computational cost at hash time. Use both: strong passwords and slow hashing.