Our Methodology
GeneratePass tools are built on established cryptographic principles and peer-reviewed research. This page explains the mathematical foundations, standards, and data sources behind our entropy calculations, strength metrics, and password analysis engines. Every formula, benchmark, and algorithm we use is documented here for transparency and reproducibility.
Last Updated: July 8, 2026
How We Calculate Entropy
Entropy measures the randomness of a password, expressed in bits. A higher entropy value indicates greater resistance to brute-force and dictionary attacks. GeneratePass calculates entropy using two complementary methods: Shannon entropy and pool-based entropy. Each method captures a different aspect of password strength, and we report the more conservative estimate as the effective entropy score.
Shannon entropy quantifies the information content of the character distribution within the password. It measures how uniformly characters are distributed across the available character set. A password that uses only one character type repeatedly will have lower Shannon entropy than one that mixes uppercase, lowercase, digits, and symbols evenly. This metric is particularly useful for detecting passwords that appear long but lack true randomness.
Pool-based entropy estimates the total search space by analyzing which character sets are present and computing the log₂ of the pool size multiplied by the password length. This method provides an upper bound on the password's resistance to brute-force attacks, assuming the attacker knows the exact character set being used. When Shannon entropy and pool-based entropy diverge significantly — for example, a long password using only lowercase letters — the lower Shannon value is reported as the effective entropy.
Our Entropy Calculator displays both metrics side by side, allowing users to understand the full picture of their password's strength. The calculator also shows the character pool breakdown and identifies which character sets are contributing to the entropy score.
| Method | Formula | Best For |
|---|---|---|
| Shannon Entropy | H = -Σ p(x) · log₂ p(x) | Character distribution analysis, detecting weak patterns |
| Pool-Based Entropy | E = log₂(pool_size) × length | Total search space estimation, brute-force resistance |
| Combined Score | min(Shannon, Pool-based) | Conservative strength estimate (used in our tools) |
Password Strength Metrics
Entropy is the foundation, but users need practical context. GeneratePass converts entropy values into estimated crack times using realistic hash rate assumptions. These estimates assume an attacker is using commodity GPU hardware performing offline dictionary and brute-force attacks against a bcrypt or SHA-256 hash.
Our strength rating system uses a four-tier scale: Weak, Fair, Strong, and Very Strong. Each tier maps to an entropy range and a corresponding minimum crack time estimate. The crack time estimates assume a single attacker with one high-end GPU; we also provide estimates for an attacker with access to a cluster of eight GPUs, representing a more sophisticated threat actor.
These metrics are displayed by our Password Strength Checker and Password Crack Time Estimator, giving users immediate feedback on the security of their passwords.
Strength Rating Scale
| Rating | Entropy | Crack Time |
|---|---|---|
| Weak | < 35 bits | < 1 hour |
| Fair | 35–59 bits | Hours to months |
| Strong | 60–90 bits | Years to centuries |
| Very Strong | > 90 bits | Centuries to millennia+ |
Hash Rate Benchmarks
Crack time estimates depend on the hashing algorithm and available hardware. We maintain reference hash rate benchmarks based on published industry research and our own testing. These benchmarks are used by our Password Crack Time Estimator to provide realistic strength assessments.
Our benchmarks reference NVIDIA RTX 4090 class hardware, which represents the current high-end consumer GPU. We provide both single-GPU and eight-GPU estimates to account for different attacker capabilities. All benchmarks are periodically validated against Hashcat performance data and academic publications on GPU-accelerated password cracking.
| Algorithm | Hash Rate (1 GPU) | Hash Rate (8 GPU) | Use Case |
|---|---|---|---|
| MD5 | ~33 billion/s | ~264 billion/s | Legacy systems, fast cracking |
| SHA-1 | ~18 billion/s | ~144 billion/s | HIBP breach checking, legacy |
| SHA-256 | ~14 billion/s | ~112 billion/s | General-purpose hashing |
| bcrypt | ~34,000/s | ~272,000/s | Password storage (recommended) |
| Argon2id | ~1,000/s | ~8,000/s | Modern password storage (preferred) |
| PBKDF2 (600k) | ~22,000/s | ~176,000/s | Enterprise credential systems |
Note: Hash rates are approximate and based on NVIDIA RTX 4090 class hardware. Actual rates vary by GPU model, driver version, and attack implementation. Our crack time estimates use conservative (higher) hash rates to ensure strength ratings are not overstated. We regularly validate these benchmarks against Hashcat performance data.
Cryptographic Standards
All GeneratePass tools are built against established cryptographic standards. We do not implement custom cryptographic primitives — every random value, hash function, and key derivation function we use is drawn from vetted, standardized libraries. This approach eliminates the class of vulnerabilities that arise from homegrown cryptography.
Our core random number generation relies exclusively on the browser-native window.crypto.getRandomValues() interface, which provides access to the operating system's cryptographically secure pseudo-random number generator (CSPRNG). This interface delegates entropy collection to the OS kernel, which gathers randomness from hardware events such as CPU timing jitter, disk I/O patterns, and other physical phenomena.
We never use Math.random() for any security-sensitive operation. The Web Crypto API is the only source of randomness in our tools, and we verify this behavior through automated testing before every deployment.
Standards We Follow
- ✓ NIST SP 800-90A — DRBG Recommendations
- ✓ NIST SP 800-63B — Digital Identity Guidelines
- ✓ W3C Web Cryptography API — CSPRNG Interface
- ✓ IETF RFC 4086 — Randomness Requirements
- ✓ FIDO Alliance — Passkey Standards
- ✓ OWASP — Authentication Cheat Sheet
Data Sources
Our tools and educational content are informed by authoritative data sources in the cybersecurity domain. We aggregate and reference data from the following categories, ensuring that every claim we make is grounded in verified, peer-reviewed, or officially published information.
We maintain an internal database of sources that is updated quarterly. When new editions of referenced publications are released — such as the annual Verizon DBIR or updated NIST guidelines — we cross-reference our content against the new data and update as needed.
| Category | Sources | Usage |
|---|---|---|
| Breach Databases | Have I Been Pwned (k-Anonymity API) | Breach Checker tool |
| Academic Research | IEEE, ACM, USENIX publications on password security | Entropy formulas, strength models |
| Industry Reports | Verizon DBIR, NIST guidelines, SANS surveys | Statistics pages, security guides |
| Standards Bodies | NIST, W3C, IETF, FIDO Alliance | Cryptographic implementation standards |
| Open Source Intelligence | Hashcat benchmarks, John the Ripper docs | Crack time estimation, hash rate data |
Tool Development Process
Every GeneratePass tool follows a rigorous development lifecycle designed to ensure correctness, security, and reliability. Our process combines standard software engineering practices with specialized security validation steps that are specific to cryptographic tool development.
Before any tool ships, it undergoes independent security auditing, cross-browser compatibility testing, and verification against reference implementations. We test entropy calculations against known test vectors from NIST and academic publications. Hash functions are verified against official test vectors published by NIST. Random number generation is validated by collecting large samples and running statistical tests.
Our Password Character Analyzer, Password Entropy Calculator, and Password Policy Checker all follow this development cycle. Each tool has a dedicated test suite that runs automatically before deployment.
Development Lifecycle
Our six-phase development lifecycle ensures that every tool meets our standards for security, accuracy, and usability. Each phase has specific entry and exit criteria, and no tool proceeds to the next phase until all exit criteria are satisfied.
| Phase | Activities | Exit Criteria |
|---|---|---|
| 1. Research | Literature review, standard analysis, threat modeling | Technical specification document |
| 2. Implementation | Client-side JavaScript, Web Crypto API integration | Working prototype with unit tests |
| 3. Security Audit | Code review, vulnerability scanning, CSPRNG verification | No critical or high-severity findings |
| 4. Cross-Browser Testing | Chrome, Firefox, Safari, Edge, mobile browsers | 100% feature parity across target browsers |
| 5. Reference Verification | Compare outputs against NIST test vectors | 100% match with reference implementations |
| 6. Deployment | Static asset build, CDN deployment, documentation | Automated build pipeline passes |
After deployment, we monitor tool performance and user feedback. Any reported issues are triaged and resolved according to our Editorial Policy correction procedures. Tool documentation is updated within 48 hours of any code change.
Methodology FAQ
Why do you use two entropy calculation methods?
Shannon entropy and pool-based entropy measure different aspects of password strength. Shannon entropy detects character distribution weaknesses (e.g., a password using only 3 unique characters). Pool-based entropy estimates the total search space. Using both provides a more complete picture — our tools report the lower of the two as the effective entropy to give users the most conservative and realistic strength estimate.
How accurate are your crack time estimates?
Our estimates are conservative approximations based on published GPU hash rate benchmarks (Hashcat, academic papers). Real-world attack speed depends on hardware, algorithm, and attacker resources. We use upper-bound hash rates to ensure our strength ratings are not overly optimistic. For detailed benchmarks, see our hash rate table above. We update these benchmarks periodically as new GPU hardware is released.
Do you store or log any calculation inputs?
No. All entropy calculations, strength checks, and password analysis happen entirely in your browser. No data is transmitted to any server. We do not log, store, or cache any inputs or outputs. This is a core part of our privacy policy and our client-side architecture described on our About page.
How do you validate your entropy formulas?
We validate against NIST test vectors and compare our outputs with established open-source implementations. Our entropy calculator is cross-referenced with academic publications on password entropy estimation, including the work of Cormack and Herley on password strength estimation methodologies. We also maintain a library of test cases with known expected outputs.
Why don't you use Math.random()?
Math.random() is not cryptographically secure. It uses a deterministic pseudo-random number generator that produces predictable sequences if the seed is known or can be guessed. For password generation and security analysis, we require true cryptographic randomness, which is provided exclusively through the Web Crypto API's window.crypto.getRandomValues() interface.
References
- NIST Special Publication 800-63B: Digital Identity Guidelines
- NIST Special Publication 800-90A: Recommendation for Random Number Generation
- W3C Web Cryptography API — W3C Recommendation
- IETF RFC 4086: Randomness Requirements for Security
- Cormack, G. & Herley, C. — "Password Strength Estimation" (ACM, 2016)
- Wheeler, D. — "Sizes and Steps in Password Cracking" (USENIX Security, 2016)
- Verizon Data Breach Investigations Report (DBIR) — Annual Publication
- Hashcat Wiki — GPU Hash Rate Benchmarks
- GeneratePass Methodology — This Page