Entropy measures the randomness or unpredictability of a password. It is expressed in bits — each additional bit doubles the number of possible combinations. Higher entropy means a password is harder to guess or brute-force.

Our tool uses the zxcvbn library, which goes beyond simple character‑set math. It detects patterns, dictionary words, sequences, repeated characters, and common substitutions to give a realistic estimation of guesses needed. If the advanced library fails to load, a fallback calculates entropy as length × log₂(charset size), which is optimistic.

Bits of entropy give a consistent, objective metric for password strength. A password with 28 bits is extremely weak (about 1 million guesses), while one with 60 bits is very strong even against offline attacks. Security guidelines often recommend at least 50–60 bits for critical accounts.

Zxcvbn (developed by Dropbox) uses a large list of common passwords, names, English words, and spatial patterns. It identifies word‑like tokens and calculates the number of guesses using combinatorial principles. This gives a far more realistic measure than simply counting character types.

The displayed crack time assumes an offline attack with 100 billion guesses per second (e.g., a fast hash like MD5). In practice, well‑protected services use slow hashes (bcrypt, Argon2) that vastly reduce the guess rate. Our tool also shows online throttled estimates when you hover over the time.

• 28 bits – too weak; instant online crack.
• 35‑40 bits – weak to moderate; may resist online attacks but off‑line trivially cracked.
• 50‑60 bits – strong for most uses; offline would require enormous resources.
• 80+ bits – very strong; considered secure against all but nation‑state attackers.

Not necessarily. A single $ for s or @ for a is a predictable substitution and adds little real entropy. Length and unpredictability (random words, arbitrary symbols in unexpected places) contribute much more. A long passphrase is often stronger than a short, complex password.

Absolutely. All analysis happens inside your browser; your password is never sent anywhere or stored. You can even disconnect your internet after the page loads and the calculator will still work.