// tool reference · Vulnerability & Assessment
Password Entropy Calculator Free
Measure real password strength in bits — not a coloured bar.
Open Password Entropy Calculator →
What it does
Calculates actual entropy in bits and estimates crack time against realistic attack rates — rather than the meaningless "strong!" meter most sites show.
When to use it
- Setting a password policy; explaining to someone why length beats symbols.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| pw | text | required | The candidate password. |
What you get back
Entropy in bits with crack-time estimates at several attack rates.
Worked example
Input
P@ssw0rd123!
Output (abridged)
ENTROPY: 38 bits -- WEAK It looks compliant: 12 chars, upper, lower, digit, symbol. It passes almost every corporate policy. It is still weak. Why: the substitutions are the ones everyone makes. a->@, o->0, plus a trailing '123!'. Cracking rule sets apply these transformations to a dictionary automatically -- the character-class variety is worth almost nothing against a real attack. CRACK TIME Online (100/s, throttled) ~87 years Offline bcrypt (10k/s) ~10 months Offline MD5/GPU (10 billion/s) ~0.03 seconds COMPARE: 'correct horse battery staple' = 44 bits, longer to crack, and easier to remember. Length beats symbol soup -- the point NIST SP 800-63B has been making since 2017.
How it works
Deterministic entropy calculation. Local — the value is not transmitted or stored.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
Entropy assumes an attacker who does not know you. A password derived from your dog's name has high calculated entropy and low real strength. Never enter a password you actively use.
Privacy
Nothing is stored or logged. Still: do not paste a password you are actively using anywhere.
Standards
NIST SP 800-63B