Password Statistics
Count a password's characters, UTF-8 bytes, uppercase, lowercase, digits, symbols, unique characters and runs, with Shannon and pool entropy.
Type a password above to analyze it. Nothing is sent anywhere.
Runs entirely in your browser. Your data is never uploaded.
What is Password Statistics Tool?
This tool breaks a password down into numbers: length in Unicode characters, UTF-8 bytes and UTF-16 code units, counts per character class, unique characters, the most frequent character, the longest run, Shannon and pool entropy, the hashcat mask and the hex bytes.
How to use Password Statistics Tool
- Type or paste the password into the Password field.
- Read the statistics grid; all values update as you type.
- Check UTF-8 bytes if a system limits passwords by bytes.
- Copy the hex value if you need the exact byte sequence.
Example
Tr0ub4dor&3
Length 11, UTF-8 bytes 11, unique 10, uppercase 1, lowercase 6, digits 3, symbols 1, most frequent "r" × 2, pool entropy 72.1 bits
When to use Password Statistics Tool
Use it when you need exact counts, for example to check a byte limit (bcrypt uses only the first 72 bytes) or to debug why a system rejects a password. To judge strength, use the strength checker.
How Password Statistics Tool works
The password is iterated by Unicode code point. Each character is classified as uppercase A–Z, lowercase a–z, digit, ASCII symbol, space or other Unicode. Bytes are counted with TextEncoder (UTF-8). Shannon entropy is −Σ p·log2(p) over character frequencies; pool entropy is length × log2(sum of class sizes).
Common Use Cases
- Checking a passphrase against bcrypt's 72-byte limit
- Debugging password rules that count characters differently
- Verifying policy requirements like 'at least 2 digits'
- Inspecting passwords with emoji or accented letters
FAQs
Why do length and UTF-8 bytes differ?
Characters outside ASCII take 2–4 bytes in UTF-8, for example é takes 2 bytes and most emoji take 4.
What counts as a symbol?
The 32 printable ASCII punctuation characters. Other non-ASCII characters are counted as 'Other Unicode'.
What is the UTF-16 count for?
JavaScript and Java measure string length in UTF-16 code units, so maxlength attributes and some APIs use this number.