Security ToolsEntropy Calculator
Calculate the Shannon entropy and estimated crack time of any password or string. Understand how character set size and length affect real-world security.
StrengthVery Weak
0.0 / 128+ bits
Length
0
characters
Detected character set size
0
possible characters
Shannon entropy
0.00
bits/char
Total entropy (bits)
0.0
bits
Estimated Crack Times
Online (throttled)—
100 guesses/s — typical rate-limited web login
Online (unthrottled)—
10,000 guesses/s — fast online service without throttling
Offline (MD5)—
10 billion/s — offline attack on a weak MD5 hash (single GPU)
Offline (bcrypt)—
100,000/s — offline attack on a bcrypt hash (GPU)
Enter a password to see crack time estimates.
Related Tools
About Entropy Calculator
How It Works
- Enter any password or string in the input field.
- The tool detects which character classes are present to determine the effective charset size.
- Shannon entropy measures information density — how unpredictable each character is on average.
- Total entropy = length × log₂(charset size). Higher bits = harder to crack.
- Crack time estimates assume an attacker stops on average at half the keyspace.
Common Use Cases
- Evaluating the real strength of a password before using it.
- Comparing different password policies (length vs complexity).
- Security awareness training — see why short passwords fail even with symbols.
- Estimating resistance to dictionary and brute-force attacks.
Frequently Asked Questions
What is entropy in the context of passwords?
Entropy is a measure of unpredictability or randomness in a password, expressed in bits. A password with higher entropy is harder to guess because it could be one of a larger number of possible values.
How is Shannon entropy calculated?
Shannon entropy is calculated using the formula: H = -Σ p(x) × log₂(p(x)), where p(x) is the probability of each character appearing. It measures how many bits of information each character carries on average.
How many bits of entropy is considered secure?
For general purposes, 60–80 bits is considered strong for online services. For high-security applications, 128 bits or more is recommended. Below 40 bits is generally considered weak.
Does this tool store or transmit my password?
No. All calculations happen entirely in your browser. Your password never leaves your device and is never sent to any server.
What attack scenarios does the tool simulate?
The tool simulates four scenarios: throttled online login (100/s), unthrottled online (10,000/s), offline MD5 attack (10 billion/s), and offline bcrypt attack (100,000/s).