Password Entropy Calculator
Password Entropy Calculator computes length × log2(pool size) using the entered text length and a manually supplied pool, defaulting to 94 when the pool is missing or invalid. It does not inspect which characters actually occur or whether the text was generated uniformly. The result is meaningful only when the sampling model is justified.
Runs locally — files stay on your deviceWhen is L × log2(P) a reasonable entropy calculation?
When each position was independently and uniformly sampled from a known pool of P equally likely symbols.
Entropy belongs to a generation process, not merely a finished string
Shannon-style bits from a uniform search space describe uncertainty before selection. A visible string does not reveal whether it came from random sampling, a person, a reused credential, or a small dictionary.
How it works
Enter the candidate text and assumed pool size. The tool multiplies its JavaScript character length by log2(pool), formats two decimals, and does not validate the generation process.
Key concepts
Pool must match the generator
A 94-character assumption is invalid if only digits were sampled.
Unicode length can be subtle
JavaScript string length counts UTF-16 code units, not necessarily user-perceived characters.
When to use it
- Calculate the idealized space for a known random generator.
- Compare pool-size assumptions.
- Teach the relationship between length and theoretical bits.
When not to use it
- Do not estimate a human-created password as uniformly random.
- Do not enter zero or negative pools and interpret the output.
- Do not use the number as an account-security guarantee.
Worked examples
Random numeric PIN model
- Input
6 characters; pool 10- Expected output
About 19.93 bits
This assumes six independent uniform digits.
Random lowercase model
- Input
12 characters; pool 26- Expected output
About 56.41 bits
The calculation describes a generator, not a dictionary word.
Human phrase
- Input
A memorable sentence; pool 94- Expected output
Potentially misleading high number
Human language violates uniform independence.
Common mistakes
Choosing pool by characters present
Seeing one digit does not prove every position was sampled from ten digits. Correction: Use the generator's actual sampling space.
Measuring a known password
Once disclosed, its uncertainty to the observer is zero. Correction: Use the metric to describe generation before disclosure.
Ignoring guessing strategies
Attackers prioritize likely human choices. Correction: Use a dedicated guessability model for chosen passwords.
Best practices
- Document the generator and pool.
- Use theoretical entropy only for uniform random sampling.
- Keep displayed bits separate from real authentication risk.
Related operations and differences
JWT Header Viewer
Choose JWT Header Viewer when you need to decode a JWT header without verifying its signature.; use Password Entropy Calculator specifically for entropy.
Password Strength Checker
Choose Password Strength Checker when you need to estimate password entropy without transmitting it.; use Password Entropy Calculator specifically for entropy.
SRI Hash Generator
Choose SRI Hash Generator when you need to generate a Subresource Integrity value for pasted content.; use Password Entropy Calculator specifically for entropy.
Basic Auth Header Generator
Choose Basic Auth Header Generator when you need to generate a Basic Authorization header locally.; use Password Entropy Calculator specifically for entropy.
HMAC Generator
Choose HMAC Generator when you need to create an HMAC using the browser Web Crypto API.; use Password Entropy Calculator specifically for entropy.
JWT Expiration Checker
Choose JWT Expiration Checker when you need to inspect the exp claim in a JWT.; use Password Entropy Calculator specifically for entropy.
Limitations and privacy
- Manual pool assumption.
- Uses JavaScript string length.
- No pattern, dictionary, breach, or attack-cost model.
The entered value is processed locally in this browser. Avoid using an untrusted device for real credentials or secrets.
Frequently asked questions
Does the tool detect the character pool?
No.
What is the default pool?
94 when the supplied value is missing or unusable.
Does more displayed entropy guarantee safety?
No.
Can it evaluate a human phrase accurately?
Not with the uniform-character formula.