Entropy & Crack Time
Analyze a password (or set length and character set) and I compute its bit entropy and crack time by brute force (online, GPU, farm). Fully local: nothing is sent.
Crack time by attack speed
| Attack scenario | Speed | Average time |
|---|
Average time = half the keyspace (2^bits ÷ 2) divided by the speed. An attacker guessing at random hits, on average, at the halfway point.
How it is calculated
1. Entropy. A random password of
length L over a pool of P symbols has
L × log₂(P) bits. Classes: lowercase 26, UPPERCASE 26, digits 10,
symbols 32 (total pool 94). A passphrase of N words drawn at random
from a dictionary of D words has N × log₂(D) bits.
2. Time. The attacker guesses at
random, so on average they cover half the space:
(2^bits ÷ 2) ÷ speed. Typical speeds: online throttled 10²/s,
online unthrottled 10⁴/s, GPU 10¹⁰/s, GPU farm 10¹²/s.
3. Assumption (Kerckhoffs). The
attacker is assumed to know the method (the pool, the length, the dictionary).
Security lives in the randomness, not in hiding how it was generated. If your
password follows a human pattern (word + year, @-for-a
substitutions), the real entropy is much lower than the theoretical
value shown here.
All analysis happens on your device. The password you type is never sent or stored anywhere.
Runs locally in your browser · no sign-up · nothing leaves your browser