Measure Password Randomness in Bits of Entropy
Password entropy is a number, measured in bits, that tells you how many guesses an attacker would need to find your password. A password built from a small set of characters and short length might have 20 bits; a long passphrase drawn from a large pool can reach 90 or more. This tool estimates that number instantly, so you can stop guessing whether a password is "strong enough" and start comparing real figures. You need it whenever you choose a new password, review an old one, or argue with a teammate about passphrase policy.
How to Measure Entropy
- Open the Password Entropy tool and paste the password you want to check into the input box.
- Review the character pool the tool detected — lowercase, uppercase, digits, and symbols each add to the pool size.
- Read the entropy estimate in bits and the equivalent key length it represents.
- Compare the result against the thresholds: 60+ bits resists online guessing, 80+ bits resists offline attacks, 128+ bits is effectively unbreakable.
- Adjust the password until it clears the threshold that matches how it will be used.
Real Example: Input and Output
A developer tests the password Sunset2024! before reusing it across tools. The tool reports the pool and length, then converts them into an entropy figure.
| Input | Output |
|---|---|
Sunset2024! | ~46 bits — weak against offline attacks |
correct-horse-battery-staple | ~75 bits — strong for most services |
Tips for Better Entropy
- Length beats complexity — each extra character adds more bits than swapping a letter for a symbol.
- Use a passphrase — four random words often beat a short mix of symbols and numbers.
- Never reuse passwords — entropy measures one password; a breach of one site still exposes the others.
- Let a generator choose — the Password Generator tool creates strings with known entropy instead of relying on your habits.
When to Use This Tool
- Before reusing an old password — confirm it actually clears modern thresholds before you trust it again.
- When setting policy — back a minimum-entropy rule with a concrete number instead of vague advice.
- After a breach — measure the passwords that were exposed and rotate anything below 60 bits.
Entropy is not a pass or fail grade; it is a measuring stick. A password that scores 50 bits may be fine for a throwaway forum account and hopeless for your email. Run the same string through the checker after every change to see how each edit moves the number, and pair the result with the Hash Crack-Time Estimator when you want the timeline behind the bits.
Frequently Asked Questions
What does the entropy number actually mean?
It is the number of bits an attacker must guess, on average, to find your password. Each bit doubles the search space, so 70 bits is twice as hard as 69 bits.
Is 40 bits of entropy secure?
No. A 40-bit password can be cracked in minutes to hours by a modern offline attack, so treat anything below 60 bits as unsafe for any account.
What entropy is safe for an online service?
Aim for at least 60 bits. Online attacks are rate-limited, so a 60-bit password survives years of guessing attempts against a typical login endpoint.
What entropy is safe if a database is stolen?
Aim for 80 bits or more. Offline attacks run at billions of guesses per second, and 80 bits pushes the expected time well past decades for any single attacker.
When is 128 bits required?
For master passwords, key material, and encryption passphrases. At 128 bits the search space is so large that brute force is considered mathematically infeasible.
Why does adding one character help more than adding symbols?
Each character position multiplies the search space by the pool size. A longer password raises the exponent, while a larger pool only raises the base, so length grows entropy faster.
Does entropy account for common passwords?
No. The estimate assumes random selection. A password like password123 scores well on paper but is trivially guessed because attackers try dictionaries first.
How is entropy different from a password strength score?
Strength scores blend multiple factors such as pattern detection and blacklists. Entropy is a single objective measure of randomness that you can compare across passwords directly.