Password Entropy Calculator
Calculate password entropy as length × log2(pool size), plus Shannon entropy and a realistic zxcvbn estimate, to see how the formulas differ.
Type a password above to analyze it. Nothing is sent anywhere.
Runs entirely in your browser. Your data is never uploaded.
What is Password Entropy Calculator?
This calculator shows the classic entropy formula for a password, length × log2(character pool), next to the Shannon entropy of its characters and a realistic estimate from zxcvbn. Comparing them shows why the classic number only applies to randomly generated passwords.
How to use Password Entropy Calculator
- Enter a password in the Password field.
- Read the Pool entropy in bits and the Pool size detected.
- Compare it with the Shannon entropy and the Realistic estimate (zxcvbn).
- Check which character classes contributed to the pool.
Example
Tr0ub4dor&3
Pool entropy 72.1 bits (pool 94, length 11); Shannon 3.28 × 11 = 36.1; realistic estimate (zxcvbn) 19.5 bits
When to use Password Entropy Calculator
Use it to check the strength of a randomly generated password or to teach how entropy is calculated. For human-chosen passwords, rely on the realistic estimate or the strength checker instead; pool entropy will overstate them.
How Password Entropy Calculator works
Pool size is the sum of the classes present: lowercase 26, uppercase 26, digits 10, ASCII symbols 32, space 1, plus the number of distinct non-ASCII characters. Pool entropy = length × log2(pool). Shannon entropy = −Σ p·log2(p) over the character frequencies, multiplied by the length. The realistic estimate is log2 of zxcvbn's guess count.
Common Use Cases
- Verifying that a generated password meets an entropy requirement (e.g. 80 bits)
- Teaching the difference between theoretical and real entropy
- Comparing character-set choices for random passwords
- Documenting password requirements in security policies
FAQs
Why are the numbers so different?
The pool formula assumes every character was picked at random. Tr0ub4dor&3 is a dictionary word with substitutions, so a smart attacker needs far fewer guesses, which zxcvbn reflects.
How many bits are enough?
For random passwords, 80 bits or more resists any practical offline attack; 128 bits is beyond brute force entirely.
Why is Shannon entropy lower than pool entropy?
Shannon entropy only measures how evenly the characters actually used are distributed, not the size of the alphabet they came from.