← All Tools
Password Entropy Tester Calculator🔒 100% local
Test password strength. Privacy-first, no server uploads, no tracking.
Related Tools
Scores one password three ways: the Shannon entropy of the characters actually used, the pool-based entropy implied by the size of the character set, and an estimated offline crack time at ten billion guesses per second. It also masks the password before echoing it and reports which character classes it found.
How to use it
- Paste the password into the box.
- Press Process. The tool echoes it back with every character replaced by an asterisk.
- Read the Estimated strength and the crack time lines together - they measure different things and can disagree.
Worked example
MyP@ssw0rd!becomesPassword: ***********
Length: 11 characters
Character pool: 95 symbols (a-z, A-Z, 0-9, symbols)
Shannon entropy: 3.28 bits/char
Total entropy: 36.1 bits
Pool-based entropy: 72.3 bits
Estimated strength: Moderate
Offline crack time: ~9012 years (at 10 billion guesses/sec)correcthorsebatterystaplebecomesPassword: *************************
Length: 25 characters
Character pool: 26 symbols (a-z)
Shannon entropy: 3.36 bits/char
Total entropy: 84.1 bits
Pool-based entropy: 117.5 bits
Estimated strength: Very Strong
Offline crack time: ~3.8e+17 years (at 10 billion guesses/sec)When to use it
- Comparing two candidate passwords before you commit to one.
- Showing someone why a long all-lowercase phrase can beat a short mixed-case one.
- Checking whether a password you already use reaches the Very Strong band.
What it does not do
- The strength label is driven by pool-based entropy, not by the Shannon figure printed above it, so a password can show 36.1 bits of total entropy and still be labelled Moderate because its pool-based score is 72.3.
- The crack time assumes exhaustive brute force at 1e10 guesses per second and knows nothing about wordlists, keyboard walks or P@ssw0rd-style substitutions, so a password that appears in every leak list still reads as roughly 9012 years.
- The input is not trimmed. A stray trailing space or a newline left on the end of a paste counts as a character and inflates both the length and the entropy.
- It is a plain text box, so the password sits in the page as you type it. Use it on a machine you trust, and prefer testing a variant of a password over the password itself.