Entropy Calculator
Analyze password cryptographic security using Shannon Information Entropy mathematics. 100% local calculation.
Brute-Force Attack Benchmarks (Est.)
| Attack Scenario | Speed Rate | Estimated Time to Crack |
|---|---|---|
| Standard Web App (throttled) | 100 guesses/sec | — |
| Desktop CPU (offline script) | 100,000 guesses/sec | — |
| GPU Brute Force (High-end) | 10,000,000 guesses/sec | — |
| GPU Cluster (Supercomputer) | 100,000,000,000 guesses/sec | — |
How entropy is calculated
Information entropy represents the complexity or unpredictability of a password. It is calculated using the formula:
Entropy (E) = L × log₂ (R)
Where L is the password character length, and R is the pool size of unique characters available. If a password contains only digits (0-9), R = 10. If it contains both digits and lowercase letters, R = 36. An entropy level above 60 bits is generally considered secure against standard offline attacks, while 80 bits or higher is highly resistant.
Introduction
How strong is your password, really? Not 'it looks complicated' — how many bits of entropy does it actually contain? The Entropy Calculator measures the true randomness of any input string using Shannon entropy, the same mathematical framework Claude Shannon pioneered in 1948 to quantify information. Paste a password, a passphrase, a PIN, or any string, and get an instant readout of its entropy in bits, its estimated crack time at various attack speeds, and a breakdown of its character distribution. This is the tool that replaces gut feelings with mathematics.
What This Tool Does
Why It Matters
Not all 'strong-looking' passwords are equally secure. A 16-character password with predictable patterns (like 'passwordpassword') has far less entropy than a random 12-character string. Shannon entropy measures the actual information content of your input by analyzing character frequency distribution — it quantifies how unpredictable your string truly is. A password with 80 bits of entropy would take a GPU cluster billions of years to crack; one with 30 bits could fall in minutes. Understanding entropy is the difference between thinking you're secure and knowing you are.
How It Works
Step-by-Step Examples
Paste the password 'k9$mPx2#nLq!vR7@wYz' into the input field
The calculator analyzes the character frequency distribution across all 20 characters
It computes Shannon entropy: H = -Σ p(x) × log₂(p(x)) for each unique character
The result shows both Shannon entropy and estimated entropy based on character pool size
Shannon entropy: 4.23 bits/char × 20 chars = 84.6 bits | Pool-based estimate: 20 × log₂(95) = 131.4 bitsEnter a weak password: 'aaaaaaaaaaaaaaaa' (16 lowercase a's)
Note the Shannon entropy: very low because there's only 1 unique character repeated 16 times
Now enter a random 16-character password with mixed characters
Compare: the random password has dramatically higher entropy despite identical length
Weak: Shannon 0.0 bits (1 unique char) | Strong: Shannon ~4.2 bits/char × 16 = ~67 bitsCode Examples
function shannonEntropy(str) {
if (!str) return 0;
// Count character frequencies
const freq = {};
for (const char of str) {
freq[char] = (freq[char] || 0) + 1;
}
// Calculate Shannon entropy: H = -Σ p(x) × log₂(p(x))
let entropy = 0;
const len = str.length;
for (const count of Object.values(freq)) {
const p = count / len;
entropy -= p * Math.log2(p);
}
return {
shannonBitsPerChar: entropy,
totalShannonBits: entropy * str.length,
uniqueChars: Object.keys(freq).length,
totalChars: len,
charDistribution: freq
};
}
// Usage
const result = shannonEntropy('k9mPx2nLq');
console.log(result.shannonBitsPerChar); // ~3.17 bits/char
console.log(result.totalShannonBits); // ~28.5 bits
console.log(result.uniqueChars); // 9function analyzePasswordEntropy(password) {
// Shannon entropy (actual information content)
const freq = {};
for (const char of password) freq[char] = (freq[char] || 0) + 1;
let shannon = 0;
for (const count of Object.values(freq)) {
const p = count / password.length;
shannon -= p * Math.log2(p);
}
// Pool-based entropy (theoretical maximum)
const hasLower = /[a-z]/.test(password);
const hasUpper = /[A-Z]/.test(password);
const hasDigit = /[0-9]/.test(password);
const hasSymbol = /[^a-zA-Z0-9]/.test(password);
let poolSize = 0;
if (hasLower) poolSize += 26;
if (hasUpper) poolSize += 26;
if (hasDigit) poolSize += 10;
if (hasSymbol) poolSize += 33;
const poolEntropy = password.length * Math.log2(poolSize || 1);
// Crack time estimates
const hashesPerSec = 1e12; // 1 trillion (large GPU cluster)
const combinations = Math.pow(poolSize, password.length);
const secondsToCrack = combinations / 2 / hashesPerSec;
return {
length: password.length,
uniqueChars: Object.keys(freq).length,
shannonBitsPerChar: shannon.toFixed(2),
totalShannonBits: (shannon * password.length).toFixed(1),
poolBasedBits: poolEntropy.toFixed(1),
poolSize,
crackTime: formatTime(secondsToCrack),
strength: poolEntropy > 80 ? 'Very Strong' : poolEntropy > 60 ? 'Strong' : poolEntropy > 40 ? 'Moderate' : 'Weak'
};
}
function formatTime(seconds) {
if (seconds < 1) return 'Instant';
if (seconds < 60) return seconds.toFixed(1) + ' seconds';
if (seconds < 3600) return (seconds / 60).toFixed(1) + ' minutes';
if (seconds < 86400) return (seconds / 3600).toFixed(1) + ' hours';
if (seconds < 31536000) return (seconds / 86400).toFixed(1) + ' days';
return (seconds / 31536000).toExponential(1) + ' years';
}
// Usage
console.log(analyzePasswordEntropy('password123'));
// { strength: "Weak", totalShannonBits: "28.5", poolBasedBits: "52.5" }
console.log(analyzePasswordEntropy('k9$mPx2#nLq!vR7@'));
// { strength: "Very Strong", totalShannonBits: "~65", poolBasedBits: "105.1" }Shannon Entropy vs Pool-Based Entropy
| Metric | What It Measures | Best For | Limitation |
|---|---|---|---|
| Shannon Entropy | Actual information content based on character frequency | Analyzing real-world passwords with patterns | Doesn't account for character pool — 'aaaa' and 'AAAA' score similarly |
| Pool-Based Entropy | Maximum entropy assuming uniform random selection | Evaluating generated passwords | Overestimates if the password has patterns or repetitions |
| Combined Analysis | Both metrics together | Comprehensive password assessment | Requires both calculations to be meaningful |
Entropy Reference Values
| Entropy (bits) | Example | Crack Resistance | Security Level |
|---|---|---|---|
| 20 | 4-digit PIN | Instant (10,000 combinations) | Very Weak |
| 30 | Common English word | Seconds to minutes | Weak |
| 40 | Short random lowercase | Minutes to hours | Moderate |
| 60 | 8-char mixed case | Days to years | Strong |
| 80 | 12-char full ASCII | Billions of years (1T h/s) | Very Strong |
| 100 | 15-char full ASCII | 10^18 years | Extremely Strong |
| 128 | 20-char full ASCII | Heat death of universe | Maximum Practical |
Benefits
- Calculates both Shannon entropy and pool-based entropy for a complete picture of password strength.
- Shows character frequency distribution so you can see exactly where entropy is gained or lost.
- Provides estimated crack time at multiple attack speeds: online (100/s), offline (1M/s), and GPU cluster (1T/s).
- Works on any input — passwords, passphrases, PINs, API keys, encryption keys, or arbitrary strings.
Use Cases
Evaluating the true strength of existing passwords to determine which ones need to be replaced.
Comparing entropy across different password generation strategies to choose the most effective approach.
Auditing password policies by testing sample passwords against entropy thresholds for different security levels.
Educating users on password strength by showing concrete entropy numbers instead of vague 'strong/weak' labels.
Common Mistakes to Avoid
Relying only on pool-based entropy and ignoring Shannon entropy — a password like 'aaaaaaaaaaaaaaaa' has pool-based entropy of 75.2 bits but Shannon entropy of 0 bits.
Assuming length alone guarantees strength — 20 characters of a repeated pattern have far less entropy than 12 truly random characters.
Using Shannon entropy as the sole metric — it measures information content, not resistance to targeted dictionary attacks.
Ignoring the difference between theoretical and practical entropy — a generated password may have 105 bits of pool entropy, but if you typed it yourself, human bias reduces actual entropy.
Security Implications
Entropy is the fundamental measure of password security. A password with 80+ bits of entropy is computationally infeasible to crack with current technology, while one with 30 bits can be brute-forced in seconds. Shannon entropy reveals patterns that pool-based calculations miss — a repeated character string may look long and complex but contains almost no actual information. Understanding both metrics is essential for accurately assessing whether your credentials can withstand offline brute-force attacks, which can now test billions of hashes per second on consumer GPU hardware.