Password Entropy: What Makes a Password Truly Strong
Password strength is not about meeting an 8-character minimum or having a capital letter — it is about entropy, the mathematical measure of unpredictability. A password like Correct-Horse-Battery-Staple has more entropy than P@ssw0rd! despite looking 'weaker' by old rules. This tool calculates Shannon entropy and estimates real-world GPU crack time so you understand exactly where your password stands.
Each additional character multiplies the search space by N. Doubling length adds log₂(N) bits. Length matters more than character variety beyond a threshold.
Shannon Entropy Explained Simply
Shannon entropy measures how many bits of information a password contains — how many yes/no questions an attacker must answer to guess it. A 10-character password using only lowercase letters has H = 10 × log₂(26) ≈ 47 bits. Add uppercase: H ≈ 57 bits. Add digits: H ≈ 60 bits. Add symbols: H ≈ 66 bits. Each additional character of length adds the same as all those pool expansions combined.
Crack Time: How Real Is the Threat
A modern GPU cluster can test 100 billion MD5-hashed passwords per second. At that rate, a 40-bit password cracks in under a second; a 60-bit password takes days; an 80-bit password takes longer than the age of the universe. Target at least 80 bits of entropy for sensitive accounts. A 5-word random passphrase (Diceware) easily exceeds 90 bits — and is far easier to remember than a 15-character symbol soup.
The Problem With Password Rules
Standard rules ('must contain uppercase, digit, and symbol') produce passwords like P@ssword1 — predictable, low-entropy, and in every cracker's wordlist with substitutions. NIST 800-63B (2017) reversed decades of advice: they now recommend length over complexity, allow all characters including spaces, and explicitly warn against forced rotation and complexity rules. The security gain from symbol requirements is smaller than the security loss from users writing down frustrating passwords.
Password Managers and Passphrases
The only reliable solution is a password manager generating a unique random password (20+ characters, full character pool) for every site. You remember one strong master passphrase; the manager stores the rest. If a site is breached and your password is unique to that site, only that account is compromised. Reusing passwords — even strong ones — is the single most common cause of account takeovers.
Entropy by Character Pool
- Lowercase only (26 chars): 4.7 bits per character
- Lower + uppercase (52 chars): 5.7 bits per character
- Lower + upper + digits (62 chars): 6.0 bits per character
- Full printable ASCII (95 chars): 6.6 bits per character
- 5-word Diceware passphrase (7776⁵ combinations): ~64 bits total
Frequently Asked Questions
What is password entropy?
Entropy measures the randomness and unpredictability of a password. Higher entropy means a stronger, harder-to-crack password. It's calculated based on password length and character variety.
What is Shannon entropy?
Shannon entropy quantifies the average information content in a message. For passwords, it measures how much uncertainty an attacker faces. Formula: H = length × log₂(pool size), where pool size is the number of unique characters possible.
What does 'Crack Time' mean?
Estimated time for an attacker using a GPU to brute-force crack your password, assuming 10 billion guesses per second. This helps you understand how secure your password really is.
Is my password safe with this tool?
Yes. All calculations are done 100% in your browser. Your password is never sent to any server or stored anywhere. It only exists in your local memory.
What password length is considered secure?
Generally, 12+ characters with mixed case, numbers, and symbols is considered strong. Aim for at least 80 bits of entropy for sensitive accounts like email and banking.
Why should I avoid special characters in some cases?
Some systems have restrictions on special characters. However, for maximum entropy and security, use special characters when allowed. The entropy calculation includes them as a security multiplier.