Calculator
What the Password Strength Checker does
Password Strength Checker: checks Entropy from Password. Example: password Tr0ub4dour&3 gives entropy 79 bits.
The inputs are Password; the output is Entropy. Change any input and the output follows immediately.
A secret that travels to a third-party server is no longer entirely a secret. That is usually what brings anyone replacing a weak password here.
This runs client-side, which means we never receive what you enter and could not retrieve it if asked.
The field reference, the method and a worked example using the default inputs follow the tool itself.
What do the Password Strength Checker fields mean?
The Password Strength Checker uses 1 input. Because the form arrives filled, the first useful result costs you zero typing.
| Field | What to enter | Default |
|---|---|---|
| Password | required | Tr0ub4dour&3 |
How does the Password Strength Checker work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same check.
An empty or malformed field stops the calculation rather than being treated as zero.
Worked example
These are the values the Password Strength Checker loads by default, and the result it produces from them. Open the tool above and you will find precisely these figures already in place.
| Password | Tr0ub4dour&3 |
|---|
| Entropy | 79 bits |
|---|
What the strength meter is actually measuring
The meter reports Shannon entropy computed from character-pool size and length. A mathematical ceiling on how hard the password would be to guess if every character were chosen independently at random. It has no way to notice that a password is a real word with predictable substitutions, because entropy math has no concept of "predictable."
| Very weak / weak | under 40 bits | Falls to a dictionary or rule-based attack, not just brute force |
|---|---|---|
| Reasonable | 40 to 60 bits | Survives casual attempts; not enough on its own for a high-value account |
| Strong | 60 to 80 bits | Comfortable margin against current offline cracking rigs |
| Very strong | 80+ bits | Beyond any realistic brute-force timeline |
Worth knowing
- "P@ssw0rd1!" scores respectably on this entropy scale (a 95-character pool, length 10) despite being one of the first candidates any real cracking tool tries, because it is a dictionary word plus the four most common substitutions. Entropy is a ceiling on difficulty, not a guarantee of it.
- A password from this site’s own password generator genuinely achieves close to its calculated entropy, because it is drawn from a CSPRNG rather than chosen by a person with habits and preferences.
- That gap between calculated entropy and real-world crackability is exactly why NIST SP 800-63B now recommends checking new passwords against known-breached lists rather than relying on entropy or composition rules alone.
Read next: What Actually Makes a Password Strong
How to use it
- Key in Password.
- There is nothing to click. The answer keeps pace with your edits.
- Read Entropy in the results panel.
- Use Copy Link if you want the same setup again later, or Print for a paper copy.
What this tool does not do
- Anything generated here is only as safe as wherever you store it afterwards.
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- No allowance is made for local rules, regional variations or house conventions.
Frequently asked questions
Just Password. Each field is pre-filled with a sensible default, so you can change one value at a time and watch how the result responds.
With the values loaded when the page opens, entropy comes out as 79 bits. Nudge one field at a time to see which one the answer is most sensitive to.
No. Nothing is transmitted or logged, which is the only acceptable design for a tool that handles credentials.
Free for any use, personal or commercial.
There is no estimation step. The result is computed, not inferred.