Password Strength & Entropy Checker
Measure a password's strength as entropy in bits (length × log2 of the character-set size), with a Very weak to Very strong rating.
Entropy: 0 bits Strength: Very weak Length: 0 Character pool: 0 Time to crack: instantly
Entropy is a rough upper bound: it does not check for dictionary words, names or reuse, so a real-world password can be weaker than the score suggests.
How this password strength checker works
Type a password and this tool measures its strength using entropy, expressed in bits. Entropy is calculated as length × log2(charset size), where the charset size is the sum of every character pool your password draws from: 26 for lowercase letters, 26 for uppercase, 10 for digits, and about 33 for symbols. A longer password, or one that mixes more character sets, has a larger search space and therefore more bits of entropy. The colored meter and the Very weak to Very strong label update live as you type.
What the bit thresholds mean
The rating uses the same bands as the password generator: under 28 bits is Very weak, under 40 is Weak, under 70 is Fair, under 110 is Strong, and 110 bits or more is Very strong. These estimate the effort of a brute-force attack that tries every combination, so they are an upper bound — a password built from common words, names, or predictable patterns can be cracked far faster than its raw entropy suggests. Use the meter as guidance, favor length, and prefer a passphrase or a password manager for anything important.
Frequently asked questions
How is the entropy calculated?
It uses length × log2(charset size). The charset size adds up the pools your password touches: 26 lowercase, 26 uppercase, 10 digits, and about 33 symbols. So an 8-character password using lowercase and digits (a 36-character pool) has about 8 × log2(36) ≈ 41 bits.
Does a high entropy score mean my password is truly safe?
Not always. Entropy assumes an attacker guesses randomly, so it is an upper bound. A password like 'Password123!' can score well on charset variety but is still weak because it follows a common pattern. Long, unpredictable passphrases are the most reliable.