Entropy & Crack Time
Analyze a password (or set length and character set) and I compute its bit entropy and crack time by brute force (online, GPU, farm). Fully local: nothing is sent.
Crack time by attack speed
| Attack scenario | Speed | Average time |
|---|
Average time = half the keyspace (2^bits ÷ 2) divided by the speed. An attacker guessing at random hits, on average, at the halfway point.
How it is calculated
1. Entropy. A random password of
length L over a pool of P symbols has
L × log₂(P) bits. Classes: lowercase 26, UPPERCASE 26, digits 10,
symbols 32 (total pool 94). A passphrase of N words drawn at random
from a dictionary of D words has N × log₂(D) bits.
2. Time. The attacker guesses at
random, so on average they cover half the space:
(2^bits ÷ 2) ÷ speed. Typical speeds: online throttled 10²/s,
online unthrottled 10⁴/s, GPU 10¹⁰/s, GPU farm 10¹²/s.
3. Assumption (Kerckhoffs). The
attacker is assumed to know the method (the pool, the length, the dictionary).
Security lives in the randomness, not in hiding how it was generated. If your
password follows a human pattern (word + year, @-for-a
substitutions), the real entropy is much lower than the theoretical
value shown here.
All analysis happens on your device. The password you type is never sent or stored anywhere.
Runs locally in your browser · no sign-up · nothing leaves your browser
How it works
The calculator estimates the entropy in bits of a password in three modes: analyzing a real password (it detects which character classes are used to build the pool), defining a policy (length from 1 to 64 plus classes: lowercase 26, uppercase 26, digits 10, symbols 32; maximum pool 94) or modeling a passphrase of N words drawn at random from a dictionary (EFF large 7776 or short 1296 words, BIP-39 2048). The formula is bits = length × log₂(pool) for characters and bits = words × log₂(dictionary) for passphrases.
From the entropy it derives the average brute-force cracking time: (2^bits ÷ 2) ÷ speed, because on average an attacker succeeds halfway through the keyspace. It compares four scenarios: throttled online attack (10² guesses/s), unthrottled online (10⁴/s), one offline GPU (10¹⁰/s) and a GPU farm (10¹²/s). The model follows Kerckhoffs principle: it assumes the attacker knows the method (pool, length, dictionary) and that security lies only in the randomness.
Example: a 12-character policy with uppercase, lowercase and digits
- Pool:
26 + 26 + 10 = 62possible symbols per position. - Entropy:
12 × log₂(62) ≈ 71.4 bits, about3.2 × 10²¹combinations → rated strong. - Average time with one GPU (10¹⁰ guesses/s):
2^70.4 ÷ 10¹⁰ ≈ 5,000 years; with a GPU farm (10¹²/s) it drops to about 50 years.