Theoretical entropy
The calculation uses length and character sets. It is transparent, but it can overestimate passwords with known words or patterns.
Programming
Password entropy calculator
Estimate theoretical entropy, detect predictable patterns and compare attack times without sending your password outside the browser.
Local assessment
Review strength, entropy and patterns
The password is processed only in this browser. It is not stored, sent or written to the URL.
0 / 256 caracteres
Interface limit: 256 Unicode code points. Do not use this tool as an account verifier in real high-risk situations.
Leaked hash with common hardware.
Leaked fast hash: 1000000000 intentos/s
Detected signals
- Signals will appear as you type.
Recomendaciones
- Use a long, unique password or a phrase made of several words.
View calculation
Theoretical entropy = length × log2(character-set size). The practical assessment can lower the rating when it detects words, sequences, repetitions, dates or obvious substitutions.
0 × log2(0) = 0 bits
Publicidad
How to interpret the result
Entropy helps estimate combinations, but actual guessing difficulty depends on patterns and context.
Practical risk
The tool penalizes common passwords, sequences, dates, repetitions and obvious substitutions such as replacing letters with numbers.
Contexto de ataque
A rate-limited service does not behave like a leaked hash tested offline with specialized hardware.
Frequently asked questions
Is the password sent to a server?
No. The calculation runs in the browser, and the tool does not store, send or add the password to the URL.
What are bits of entropy?
They are a way to estimate the size of the search space. More bits generally mean more possible combinations, although they do not guarantee real security.
Why can a long password be weak?
Because it may include common words, sequences, dates or repetitions that an attacker would try before a fully random search.
Can a long passphrase be better than a short password with symbols?
Yes, if it is unique and does not use a popular phrase. Length adds a great deal and is often easier to remember than obvious substitutions.
Does entropy guarantee security?
No. Risk also depends on breaches, phishing, malware, password reuse, MFA and service policies.
What is the difference between an online and offline attack?
An online attack usually has attempt limits. An offline attack occurs when a hash has leaked and can be tested many times per second.
Should I use a password manager, MFA or passkeys?
Yes. A manager helps create long, unique passwords, while MFA or passkeys reduce risk if a password is leaked.