Entropy Calculator
Measure the true mathematical entropy of any password string in bits (Hartley & Shannon) and analyze crack times across real-world GPU attacker scenarios.
Information Theory Engine
Calculates logarithmic brute-force difficulty: E = L × log₂(R) alongside Shannon per-symbol redundancy.
Maximum possible entropy assuming uniformly distributed characters chosen from a pool of 95 symbols.
Empirical information density penalizing repeated characters and symbol redundancies.
Character Pool Composition
Crack Time Estimates
Calculates estimated average time required to exhaust 50% of the brute-force search space across distinct attacker hardware models.
Information Theory Password Entropy Measurement
The Entropy Calculator computes the mathematical unpredictability of any password or string using classical information theory. While standard password meters frequently rely on crude regex checks, entropy provides an objective, logarithmic measure of the total brute-force search space an attacker must traverse to crack a credential.
This tool analyzes both Hartley theoretical entropy (E = L × log2(R)) based on character pool cardinality and Shannon informational entropy (H = -Σ p_i log2(p_i)) to account for symbol redundancy and character frequency skew. An adjusted entropy score is then derived by penalizing sequential runs, keyboard walk patterns, and consecutive duplicate characters.
To translate abstract bit measurements into concrete security assessments, the utility models estimated crack times across five realistic attacker scenarios. ranging from rate-limited online web authentication to high-speed offline GPU cracking rigs processing 100 billion hash guesses per second.
Core Tool Capabilities
- Hartley Theoretical Entropy: Calculates maximum theoretical bits of entropy based on string length and total detected character pool cardinality.
- Shannon Informational Entropy: Evaluates per-symbol probability distribution, quantifying character repetition and structural redundancy.
- Pattern Penalty Calibration: Applies mathematical penalties for sequential character runs (123, abc), identical repeats (aaa), and physical keyboard walks (qwerty).
- Multi-Threat Crack Time Modeling: Estimates exhaustive search duration against online throttled, fast online, GPU slow-hash, and GPU fast-hash threat models.
- Character Pool Inspection: Breaks down exact character counts and percentage contributions across lowercase, uppercase, numbers, symbols, and unicode.
- Real-Time Volatile Evaluation: Performs all calculations locally within client RAM with zero keystroke recording or network transmission.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Password Policy Auditing & Design
- • Credential Hardening Assessment
- • Diceware & Passphrase Validation
- • Computer Science Education
Technical Specifications & Platform Limits
Evaluates combinatorial search space based on length and pool size.
Measures entropy density taking character frequency into account.
Automatic classification of all input character sets.
Empirical crack time estimations across five realistic hardware tiers.
Processes inputs locally with no network calls or persistence.
Step-by-Step Workflow
Enter Password String
Type or paste any password, token, or phrase into the input box, or select a pre-configured sample to test.
Inspect Entropy Bits
Review the calculated adjusted entropy, theoretical Hartley entropy, and Shannon per-character density scores.
Review Character Distribution
Examine the character pool cards to see which character classes are contributing to your search space.
Evaluate Crack Time Estimates
Check the crack time table to determine how resilient the password remains against modern GPU-accelerated hashing clusters.
Practical Real-World Use Cases
Password Policy Auditing & Design
Security engineers establishing minimum entropy benchmarks for corporate identity providers and single sign-on systems.
Credential Hardening Assessment
Individuals testing their existing master passwords and sensitive credentials to determine if an upgrade is warranted.
Diceware & Passphrase Validation
Verifying that multi-word passphrases achieve expected 55+ bit entropy thresholds before applying them to encrypted volumes.
Computer Science Education
Students and researchers studying information theory and observing how character pool expansion logarithmically multiplies search space.
Frequently Asked Questions
- Is my password safe to type into this entropy calculator?
- Yes. The calculator runs entirely within your browser's local JavaScript execution context. No network requests are made, no keystrokes are logged, and no data is saved.
- What is considered a good entropy score in bits?
- Under modern cryptographic standards, less than 36 bits is very weak and vulnerable to instant cracking. 60 to 79 bits is considered reasonable for standard web logins, while 80 to 127 bits provides strong resistance. Over 128 bits is practically uncrackable by brute force.
- What is the difference between Hartley and Shannon entropy?
- Hartley entropy assumes every character in a pool has an equal chance of appearing anywhere in the string. Shannon entropy measures the actual observed frequency of each character, penalizing passwords that repeat the same characters frequently.
- Why does the tool show different crack times for different attack scenarios?
- Different attack vectors possess vastly different compute capabilities. A rate-limited web login might permit only 100 guesses per hour, while an attacker who captures an unsalted MD5 or NTLM password hash can test over 100 billion guesses per second on a modern GPU rig.
- Does adding length increase entropy faster than adding special symbols?
- Yes. Length increases entropy linearly with multiplication (L × log2(R)), whereas expanding the character pool only increases the logarithmic factor log2(R). A 16-character lowercase password has more entropy (75.2 bits) than an 8-character password with all symbols included (52.4 bits).
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind Entropy Calculator with our deep-dive educational content.
Zero-Log Architecture for Browser-Native Tools
Understanding mathematical entropy and why client-side evaluation protects against keyloggers.
Generate OpenPGP Keys Locally with a Browser-Native PGP Key Generator
How information-theoretic entropy models quantify resistance against multi-GPU brute-force attacks.
Why Browser-Based Data Masking Fits Secure Enterprise Workflows
Preventing accidental exposure of credentials when auditing password complexity.