Skip to main content
Kalcufy

Password Strength Calculator

Analyze password entropy, detect weak patterns, and estimate crack times across 7 attack scenarios — including quantum computing. 100% private, nothing leaves your browser.

Password Security Best Practices

  • Use 16+ characters — each extra character exponentially increases security. Length beats complexity.
  • Avoid predictable patterns: keyboard walks (qwerty), sequences (12345), repeated characters (aaa), and leet speak (P@$$w0rd).
  • Passphrases of 5+ random words are easy to remember and provide 60+ bits of entropy.
  • Use a password manager to generate truly random, unique passwords for every account.

What Is Password Entropy?

Password entropy measures the unpredictability of a password in bits. It represents the number of binary yes/no decisions an attacker must make to guess your password through brute force. A password with 40 bits of entropy has 2⁴⁰ (about 1.1 trillion) possible combinations. Each additional bit doubles the search space, making the password exponentially harder to crack. The formula is: Entropy = Length × log₂(Charset Size). For example, an 8-character password using only lowercase letters (charset = 26) has 8 × 4.7 = 37.6 bits of entropy. However, raw entropy assumes each character is perfectly random — real-world passwords often contain patterns that reduce their effective strength. This calculator detects those patterns and applies penalties to give you a more realistic security assessment.

How This Calculator Works

This calculator goes beyond simple entropy math by applying a multi-layer analysis. First, it calculates raw entropy from the character set size and password length. Then it scans for weakness patterns: common passwords (top 200 from breach databases), keyboard walks (qwerty, asdf), sequential characters (abc, 123), repeated characters (aaa), leet speak substitutions (@ for a, 0 for o), and trailing year patterns (2024, 2025). Each detected pattern applies an entropy penalty, producing an 'effective entropy' score that better reflects real-world crackability. Crack times are estimated for 7 scenarios: from rate-limited online attacks (100 guesses/sec) to theoretical quantum computers using Grover's algorithm (which halves the effective bit length). All analysis runs entirely in your browser — your password is never transmitted anywhere.

Critical Security Considerations

  • Length beats complexity: a 20-character lowercase password (94 bits) is stronger than an 8-character mixed password (52 bits). Always prioritize length.
  • Common passwords like 'Password123!' have near-zero real entropy despite using all character types. Attackers check dictionary and breach lists first.
  • Keyboard patterns (qwerty, zxcv), sequences (abcd, 1234), and leet speak (P@$$w0rd) are the first things cracking tools try after dictionaries.
  • Passphrases of 5+ random words provide 60+ bits of entropy and are much easier to remember than random character strings.
  • Password managers generate truly random passwords — the only way to guarantee maximum entropy. Use one for every account.
  • Multi-factor authentication (MFA) protects you even if your password is compromised. Enable it everywhere possible, especially for email, banking, and cloud accounts.

Entropy Strength Levels

  • 0–28 bits (Very Weak): Crackable in seconds. Includes common passwords, short PINs, single dictionary words, and trivial patterns.
  • 28–35 bits (Weak): Crackable in minutes to hours offline. Short mixed-case passwords, simple substitutions like P@ss, phone numbers.
  • 36–59 bits (Fair): Takes days to years offline. Medium-length passwords with some complexity. Adequate for low-value accounts only.
  • 60–79 bits (Strong): Would take decades to centuries. Long passwords or 4+ word passphrases. Good for most accounts.
  • 80–127 bits (Very Strong): Effectively uncrackable by current technology. Random 16+ character passwords. Recommended for critical accounts.
  • 128+ bits (Maximum): Exceeds encryption-grade security. Even quantum computers would need astronomical time. Overkill for most purposes.

Password Entropy Examples

Step-by-step calculations showing raw vs effective entropy

Weak: password123

  1. Charset: lowercase (26) + digits (10) = 36
  2. Length: 11 characters
  3. Raw entropy = 11 × log₂(36) = 11 × 5.17 = 56.8 bits
  4. ⚠️ Pattern detected: common password match → −30 bits penalty
  5. ⚠️ Pattern detected: sequential digits (123) → −10 bits penalty
  6. Effective entropy = 56.8 − 40 = 16.8 bits → Very Weak

Despite 56.8 bits raw entropy, the effective entropy is only 16.8 bits because 'password123' is in every breach database. It would be cracked instantly.

Strong: kQ8#mL!2xP$5nR7&wZ

  1. Charset: lower (26) + upper (26) + digits (10) + symbols (32) = 94
  2. Length: 18 characters
  3. Raw entropy = 18 × log₂(94) = 18 × 6.55 = 117.9 bits
  4. ✅ No patterns detected → 0 penalty
  5. Effective entropy = 117.9 bits → Very Strong
  6. GPU cluster crack time: 2.1 × 10¹⁵ years

117.9 bits with no penalties. This truly random password is effectively uncrackable by any current or near-future technology.

Frequently Asked Questions

Is it safe to type my real password here?

Yes. This calculator runs 100% in your browser using JavaScript — your password is never sent to any server, API, or third party. All analysis happens locally on your device. You can verify this by disconnecting from the internet and using the calculator offline. We never store, log, or transmit your input.

What is the difference between raw and effective entropy?

Raw entropy is the theoretical maximum based purely on password length and character set size (the classic formula: Length × log₂(charset)). Effective entropy accounts for real-world weaknesses: if your password contains common words, keyboard patterns, sequential characters, or leet speak substitutions, attackers don't need to brute-force every combination. They try these patterns first. Effective entropy subtracts penalties for each detected pattern, giving a more realistic security score.

How long should my password be?

At minimum 14 characters, ideally 16 or more. NIST SP 800-63B recommends at least 8 characters as a baseline, but modern security experts and organizations like CISA recommend 16+. Every additional character multiplies the search space by the charset size — adding one character to a mixed-case alphanumeric password multiplies brute-force difficulty by 62×. A 20-character password has over a billion times more combinations than a 14-character one using the same charset.

Are passphrases better than random passwords?

For memorability, yes. A 5-word passphrase from a 7,776-word list (like EFF's Diceware) has about 64 bits of entropy — equivalent to a 10-character random mixed password. A 7-word passphrase reaches 90 bits. Passphrases are much easier to type and remember. However, the words must be truly random (not a sentence you'd naturally say). For maximum security, a random 18+ character password from a password manager is still the gold standard.

What is the quantum computing scenario?

Grover's algorithm allows a quantum computer to search an unsorted database in √N operations instead of N. For passwords, this effectively halves the entropy bits: a 128-bit password becomes equivalent to 64 bits against a quantum attack. Current quantum computers are far too small and error-prone for this, but it's a useful planning metric. The standard recommendation is to use passwords with 128+ bits of entropy to remain secure even against future quantum threats.

Why does 'P@$$w0rd!' score poorly despite using all character types?

Because real attackers don't brute-force character by character — they use dictionaries, breach databases, and rule-based attacks that try common substitutions first. 'P@$$w0rd!' is a leet-speak variant of the #1 most common password in the world. Password crackers like Hashcat and John the Ripper include rules that automatically try a→@, s→$, o→0, and similar substitutions. The raw entropy formula assumes each character is random, but these patterns make the password highly predictable.

Sources