Password Entropy Calculator

Introduction

Entropy is the only objective measure of password strength. Not 'weak/medium/strong' — bits. The Password Entropy Calculator applies Shannon's information theory to your password, measuring exactly how many bits of unpredictability it contains. A password with 80 bits of entropy requires 2⁸⁰ operations to crack — more than every grain of sand on Earth. A password with 40 bits can be cracked on a laptop in an afternoon. This tool tells you the number that matters.

What This Tool Does

A password entropy calculator is a tool that measures the information-theoretic randomness of a password using Shannon entropy, calculated as E = L × log₂(R) where L is password length and R is the size of the character pool. It detects which character classes are present (lowercase=26, uppercase=26, digits=10, symbols=33), calculates the effective pool size, and computes per-character entropy as log₂(R). Total entropy is the product of length and per-character entropy. The tool also measures distribution entropy — the actual randomness of character selection within the password — to distinguish between theoretically high-entropy passwords that follow predictable patterns and truly random ones.

Why It Matters

How It Works

The calculator first scans the password to detect which character classes are present using regex patterns: /[a-z]/ for lowercase (26), /[A-Z]/ for uppercase (26), /[0-9]/ for digits (10), /[^a-zA-Z0-9]/ for symbols (33). The pool size R is the sum of all detected class sizes. Per-character entropy is log₂(R), which equals 4.70 bits for lowercase-only, 5.70 for mixed case, 5.95 for alphanumeric, and 6.57 for full ASCII. Total theoretical entropy is L × log₂(R). The tool also calculates distribution entropy using the formula -Σ p(c) × log₂(p(c)) where p(c) is the frequency of each character, measuring actual character diversity. Effective entropy is the minimum of theoretical and distribution-based entropy, accounting for passwords that use a large pool but select characters non-randomly.

Step-by-Step Examples

Code Examples

function calculateShannonEntropy(password) {
  if (!password) return { entropy: 0, poolSize: 0 };

  const classes = {
    lowercase: /[a-z]/.test(password) ? 26 : 0,
    uppercase: /[A-Z]/.test(password) ? 26 : 0,
    digits: /[0-9]/.test(password) ? 10 : 0,
    symbols: /[^a-zA-Z0-9]/.test(password) ? 33 : 0
  };

  const poolSize = classes.lowercase + classes.uppercase + classes.digits + classes.symbols;
  const perChar = Math.log2(poolSize || 1);
  const totalEntropy = password.length * perChar;

  // Distribution entropy (actual character diversity)
  const freq = {};
  for (const char of password) freq[char] = (freq[char] || 0) + 1;
  let distributionEntropy = 0;
  for (const count of Object.values(freq)) {
    const p = count / password.length;
    distributionEntropy -= p * Math.log2(p);
  }

  const effectiveEntropy = Math.min(totalEntropy, distributionEntropy * password.length);
  const combinations = Math.pow(2, effectiveEntropy);

  return {
    length: password.length, poolSize, perCharBits: perChar.toFixed(2),
    theoreticalEntropy: totalEntropy.toFixed(1),
    effectiveEntropy: effectiveEntropy.toFixed(1),
    combinations: combinations.toExponential(2)
  };
}

console.log(calculateShannonEntropy('k9mPx2nLq'));
// { poolSize: 62, perCharBits: "5.95", theoreticalEntropy: "53.6" }

function comparePasswordEntropy() {
  const passwords = [
    { name: '8-char lowercase', value: 'abcd1234' },
    { name: '12-char mixed (pattern)', value: 'P@ssw0rd123' },
    { name: '16-char random', value: 'k9mP2xNq7rL4vW8y' },
    { name: '5-word passphrase', value: 'correct horse battery staple' },
    { name: '20-char full random', value: 'aK9$mPx2#nLq!vR7@wYz' }
  ];

  return passwords.map(p => {
    const entropy = calculateShannonEntropy(p.value);
    return {
      name: p.name, length: p.value.length,
      entropy: entropy.effectiveEntropy,
      bitsPerChar: (entropy.effectiveEntropy / p.value.length).toFixed(2)
    };
  });
}

Benefits

• Calculates Shannon entropy using the formula E = L × log₂(R) where L is length and R is the character pool size.
• Detects character classes automatically and computes per-character entropy for each pool size.
• Measures actual character distribution entropy to identify passwords with low diversity despite high pool size.
• Provides theoretical and effective entropy — showing the difference between what's possible and what your password actually achieves.
• Compares entropy across generation methods: human-chosen vs. random vs. Diceware passphrases.

Use Cases

Common Mistakes to Avoid

Security Implications

Security Information

All calculations run locally in your browser. No password data is transmitted. The entropy calculations are based on Claude Shannon's 1948 information theory paper and are mathematically provable. The tool distinguishes between theoretical entropy (based on character pool size) and effective entropy (accounting for actual character distribution), giving you a more accurate picture of your password's true strength.

Best Practices

• Aim for 80+ bits of entropy for general accounts, 100+ bits for high-value accounts.
• Remember that entropy depends on both length AND character diversity — a 20-character lowercase password has less entropy than a 12-character mixed-character password.
• Use the effective entropy (not theoretical) to evaluate your password — it accounts for predictable patterns.
• For password manager master passwords, 80+ bits is sufficient because the vault adds additional encryption layers.
• Each additional bit of entropy doubles the attacker's work — the difference between 80 and 100 bits is a factor of over one million.