What is Shannon entropy in passwords?

Entropy measures the unpredictable information content of a password in bits. A 60-bit password requires 2^60 guesses to exhaust, while 80+ bits is considered uncrackable by modern supercomputers.

Why are passphrases better than short complex passwords?

Four random dictionary words (e.g., "correct-horse-battery-staple") have ~66 bits of entropy, making them practically impossible for GPUs to brute force while remaining easy for humans to remember.

How are the crack time calculations determined?

We compute the total mathematical combinations (keyspace) divided by realistic attacker hardware guess rates (from 100 guesses/hour for web portals up to 10 billion guesses/second for offline GPU clusters).

Password Entropy & Strength Auditor

Top Tool100% In-Browser

Calculate true Shannon entropy, estimate brute-force crack times across 4 threat levels (online rate-limit to 10 GH/s GPU clusters), and generate secure passwords.

100% Client-Side Cryptographic Analysis

Passwords entered or generated here are calculated in local memory. Nothing is ever sent over the network.

Test Any Password

Rating: Uncrackable118 bits of entropy (18 chars)

Estimated Brute-Force Crack Times by Threat Model

Assuming 50% keyspace traversal

Online Web Rate-Limit

100 attempts / hour

Trillions of years (Uncrackable)

Online Unthrottled API

100 attempts / second

Trillions of years (Uncrackable)

Offline Slow Hash

Argon2 / bcrypt (10k/sec)

Trillions of years (Uncrackable)

Offline Fast GPU Rig

MD5 / SHA-256 (10 GH/s)

Trillions of years (Uncrackable)

Generate Cryptographically Secure Password

Zero Data Collection

Files are processed 100% locally

Instant Client-Side Speed

Zero network upload delays

Free & Unlimited

No registration or credit card needed

Password Entropy & Multi-Tier Brute-Force Crack Time Calculator

Why we built this: Most website password meters use simplistic length rules that label predictable passwords like "P@ssword123!" as "Strong". In reality, modern offline GPU rigs test billions of guesses per second using dictionary mutations. We built this auditor to provide honest Shannon entropy metrics and realistic crack time estimates across multiple threat models.

How it works: 1) Type or generate a password. 2) The auditor computes information entropy (bits of randomness based on character space and length), audits against top common passwords, repeated characters, and keyboard patterns. 3) View real-world crack times across four threat tiers: online rate-limited (100/hr), unthrottled API (100/sec), slow hash (10k/sec bcrypt/Argon2), and fast GPU cluster (10 GH/s).

Also includes a cryptographically secure random password and Diceware passphrase generator powered by window.crypto.getRandomValues, creating memorable, high-entropy passphrases that resist GPU cracking.

Frequently Asked Questions

Everything you need to know about using Password Entropy & Strength Auditor safely and efficiently.

Yes. All entropy calculations, pattern matching, and crack time projections run 100% locally in your browser memory. Nothing is sent over the internet.

Recommended Next Steps

Related Online Utilities

DeveloperSecurity

Client-Side File Encryptor & Decryptor

Encrypt and decrypt any file using military-grade AES-256-GCM and PBKDF2 (100,000 rounds) via the native Web Crypto API. Zero server uploads.

Use Tool

DeveloperEphemeral

Zero-Knowledge Secret Note Generator

Create self-destructing encrypted notes. AES-256-GCM encryption key is stored in the URL hash fragment (#key=...) which is mathematically never sent to web servers.

Use Tool

DeveloperPrivacy

Client-Side PII & Data Scrubber

Sanitize logs, databases, and documents. Client-side regex & Luhn detection masks emails, phone numbers, credit cards, API keys, IP addresses, and SSNs with reversible token maps.

Use Tool