About this tool
The security of your digital accounts is directly determined by the mathematical entropy of your passwords. Our Password Strength Checker computes live algorithmic feedback to show you exactly how vulnerable your credentials are to automated brute-force attacks.
What is Password Entropy?
Instead of relying on arbitrary rules (like requiring capital letters or numbers), security experts measure the strength of a password by its cryptographic entropy. Entropy measures the difficulty of guessing a password by calculating the size of the search space in bits.
The Shannon Entropy ($E$) of a password is mathematically defined by the following formula:
$$E = L \times \log_2(R)$$
Where:
- $E$ is the password entropy measured in bits.
- $L$ is the character length of the password string.
- $R$ is the size of the pool of possible characters (character set size).
Brute-Force Search Space & Scale
Each additional bit of entropy doubles the difficulty of cracking the password. For example, a password with $40$ bits of entropy takes $2^40$ operations to exhaustively search, while $80$ bits of entropy takes $2^80$ operations.
Worked Mathematical Example: Short Complex vs. Long Simple
To understand why length is more important than complexity, let us compare two passwords:
Scenario A: Short & Complex (Pa$$w0rd)
This password uses lowercase letters, uppercase letters, numbers, and special symbols.
- Length ($L$) = $8$ characters
- Character pool size ($R$) = $95$ characters (uppercase, lowercase, digits, symbols)
- Entropy calculation:
The total search space consists of $95^8 \approx 6.63 \times 10^15$ combinations. A high-performance cracking rig can test billions of hashes per second, making this crackable in hours.
Scenario B: Long & Simple (correct-horse-battery)
This password uses only lowercase letters and hyphens.
- Length ($L$) = $21$ characters
- Character pool size ($R$) = $27$ characters (lowercase letters + hyphens)
- Entropy calculation:
The total search space consists of $27^21 \approx 6.09 \times 10^29$ combinations. Even though the character pool is much smaller, the increased length makes the key space exponentially larger, rendering it completely uncrackable by modern computers.
As demonstrated, adding characters increases entropy exponentially (since $L$ is a multiplier of the logarithm), whereas increasing character pool complexity only increases it logarithmically (since $R$ is inside the logarithm).
Frequently asked questions
Everything you need to know about Password Strength Checker.
Does the password I type get sent to a server?
Never. The entropy calculation runs entirely inside your browser in JavaScript. Your password is never transmitted over the network, logged, or stored anywhere. You can safely test real passwords.
What entropy score is considered a strong password?
Security researchers generally consider 60–80 bits of entropy to be strong and 80+ bits to be very strong for most threat models. Below 40 bits is considered weak and vulnerable to offline brute-force attacks with modern hardware.
Why is a long simple password stronger than a short complex one?
Entropy grows as L × log₂(R), where L is length and R is character pool size. Length is a linear multiplier, while increasing the character set only adds a logarithm. Adding 4 characters to a password is more impactful than switching from lowercase only to mixed-case. A 20-character lowercase passphrase can easily outrank an 8-character mixed-case password.
How many characters should a truly secure password have?
For most accounts, 16+ characters using mixed case, digits, and symbols achieves 90+ bits of entropy — sufficient against even high-speed offline attacks. For highest security (e.g. encryption keys), use 32+ characters or a cryptographically generated passphrase.
Does the checker test my password against known breach databases?
The entropy checker focuses on mathematical strength rather than breach-list matching. For breach checking, you can additionally use services like HaveIBeenPwned.com, which use k-anonymity to check hashed prefixes without revealing your full password.