How to use it
Type or paste a password into the box. Hit Show if you want to see what you typed.
The strength bar, the entropy figure, and the crack-time estimate all update on each keystroke. Suggestions underneath tell you what would actually improve this specific password rather than reciting generic rules.
What entropy in bits actually means
Entropy measures how many guesses an attacker would need. Each extra bit doubles that number, so the scale is exponential rather than linear.
The calculation multiplies password length by the base-2 logarithm of the character pool. Lowercase alone gives a pool of 26. Add uppercase and it is 52. Add digits, 62. Add symbols and you reach about 95.
| Entropy | Verdict |
|---|---|
| Under 40 bits | Weak |
| 40 to 60 bits | Moderate |
| 60 to 80 bits | Strong |
| Over 80 bits | Very strong |
Length beats complexity, and the maths shows why. Adding one character to a lowercase-only password multiplies the possibilities by 26. Adding symbols to an eight-character password multiplies them by roughly 95 divided by 62, which is about 1.5. One extra character is worth more than switching to the biggest character set.
Why this number is optimistic
Here is the honest limitation of every entropy meter, including this one.
The formula assumes you picked your characters at random. Almost nobody does. P@ssw0rd1! scores well on the formula, because it is ten characters spanning all four character types. Against a real attacker it collapses in seconds, since every cracking tool has run dictionary words through those exact substitutions for over twenty years. The a-to-@ and o-to-0 swaps are not a clever trick. They are the first thing tried.
Same for a name and a birth year, a keyboard walk like qwertyuiop, or any word with a number bolted on the end. The formula sees length and variety. The attacker sees a pattern they have a rule for.
Read the score as a ceiling on your password's strength, not a measurement of it. It tells you the best case if your choice were random. Anything predictable in there brings the real figure down, sometimes by an enormous margin.
What NIST actually recommends now
Most password advice online is a decade out of date. The current US standard,NIST Special Publication 800-63B, reversed several rules that everyone still repeats. Composition rules are the first casualty. NIST now advises against demanding a mix of uppercase, lowercase, digits and symbols, and the reason is behavioural rather than mathematical. Force those rules and people reach for the same workaround every time: capital at the front, digit and exclamation mark at the end. That shrinks the real search space rather than growing it.
Scheduled expiry is out as well. Do not force periodic changes, NIST says. Rotate on suspected compromise and not otherwise. Ninety-day rotation is what turned Summer2024! into Autumn2024! across half the offices on earth.
Length is what NIST does want. Eight characters is the floor. Fifteen or more is the recommendation wherever a password is the only protection. Systems should accept at least 64, so a long passphrase never gets rejected for being too long.
Passphrases and the Diceware numbers
Four random words beat a short mangled password. The arithmetic backs it up.
The standard Diceware list holds 7,776 words. Pick one truly at random and you have added about 12.9 bits. Four words come to roughly 51.7 bits. Six words reach about 77.5, which is very strong, and you can still say it out loud and remember it tomorrow.
The catch sits in that word "random". A phrase you invented is not random. You picked words that go together, and your brain has preferences it never tells you about. correct horse battery staple became famous precisely because those four words have no business being next to each other. Roll dice, or let software choose, then keep whatever comes out even when it feels silly.
Where password managers fit
A manager fixes the problem this meter cannot. It picks genuinely random strings, so the entropy number is honest instead of a ceiling. It also removes any need for the password to be memorable.
Type your passwords from memory and you are stuck with a handful of good ones. So you reuse them. Reuse is what turns one company's breach into a problem on every account you own, and no amount of strength in the password itself protects you from it.
Frequently asked questions
Does this check my password against known breaches?
No. It rates strength from the characters themselves, and flags a small set of very common passwords. Checking a breach corpus is a different kind of tool, and it has to look your password up somewhere.
Is a passphrase really better than symbols?
Usually. The words have to be picked randomly, though. Six random words run about 77 bits. That beats almost any twelve-character password a person invents unaided.
Why does my complicated password score lower than I expected?
Length, most likely. The meter leans on length because the maths does. Twelve simple characters beat eight complicated ones.
Should I change my passwords every 90 days?
No, and NIST has said so for years now. Scheduled changes just push people into predictable variations of the same thing. Change a password when you have a reason to think it leaked.
What password length should I aim for?
Fifteen or more anywhere a password is the only thing guarding an account. Eight is the floor. It is a low one.
Does adding one symbol at the end help much?
Barely. It nudges the pool size and adds almost nothing real, because that is the first position an attacker tries. Two or three more characters of genuine length does far more.
Related: generate a strong password · random strings for API keys · hash a value.