Password Strength & Entropy Checker
Estimate a password's entropy in bits, get a Very weak to Very strong rating, and see which character sets it uses — runs 100% in your browser, nothing is uploaded.
Entropy: 0 bits Strength: Very weak Length: 0 Time to crack: instantly
🔒 Strength is estimated in your browser — nothing is stored or uploaded. Entropy is a rough upper bound: it does not check for dictionary words, names or reuse, so a real-world password can be weaker than the score suggests.
How this password strength checker works
Type a password and this tool measures its strength using entropy, expressed in bits. Entropy is calculated as length × log2(charset size), where the charset size is the sum of every character pool your password draws from: 26 for lowercase letters, 26 for uppercase, 10 for digits, and about 33 for symbols. A longer password, or one that mixes more character sets, has a larger search space and therefore more bits of entropy. The colored meter and the Very weak to Very strong label update live as you type.
What the bit thresholds mean
The rating comes from well-known entropy bands: under 28 bits is Very weak, under 36 is Weak, under 60 is Fair, under 128 is Strong, and 128 bits or more is Very strong. These estimate the effort of a brute-force attack that tries every combination, so they are an upper bound — a password built from common words, names, or predictable patterns can be cracked far faster than its raw entropy suggests. Use the meter as guidance, favor length, and prefer a passphrase or a password manager for anything important.
Frequently asked questions
How is the entropy calculated?
It uses length × log2(charset size). The charset size adds up the pools your password touches: 26 lowercase, 26 uppercase, 10 digits, and about 33 symbols. So an 8-character password using lowercase and digits (a 36-character pool) has about 8 × log2(36) ≈ 41 bits.
Does a high entropy score mean my password is truly safe?
Not always. Entropy assumes an attacker guesses randomly, so it is an upper bound. A password like 'Password123!' can score well on charset variety but is still weak because it follows a common pattern. Long, unpredictable passphrases are the most reliable.
Is my password sent anywhere or stored?
No. Everything is computed locally in your browser with JavaScript. Your password is never sent to a server, saved, or uploaded — you can even disconnect from the internet and the tool still works.