Kit-Bin
Donate

Password Entropy Checker

See the actual math behind how hard a password is to guess, calculated locally as you type.

Processed entirely in your browser. Never uploaded to a server.

Nothing typed yet — the entropy and crack-time estimate appear here as you type.

This tool runs the same formula the entropy guide below walks through, entropy in bits equals length times log2 of the character-set size, against whatever you actually type, live, in this browser tab. Nothing is uploaded, and nothing is stored once you navigate away.

What the crack-time estimate assumes

The estimate assumes a fast offline attack against a hash dump, roughly 10 billion guesses per second on current consumer hardware, and reports the time to a 50% chance of a match across the full keyspace. An online login form that rate-limits attempts is far slower to attack than this, and a password already sitting in a leaked-credentials list is effectively instant to guess regardless of what this number says, see the FAQ below.

FAQ

Is my password sent anywhere while I type it?
No. Everything is calculated in this browser tab as you type. Nothing about the password you enter here is logged, stored, or transmitted anywhere, including to Kit-Bin.
How is the entropy calculated?
Entropy in bits = length × log2(character-set size). The character-set size is based on which categories actually appear in what you typed (lowercase, uppercase, digits, symbols), not the maximum possible, so "password" and "PaSsWoRd" score differently even though they are the same length.
Why does the crack-time estimate look so different from what another site shows me?
Crack-time estimates are only ever a rough order of magnitude, they depend entirely on an assumed guessing speed, which varies hugely by attack type (online vs. an offline hash dump) and hardware. This tool assumes a fast offline attack, roughly 10 billion guesses per second, and shows time to a 50% chance of a match, not a guarantee either way.
Does a high entropy score mean this password is safe to use?
Not by itself. This score only measures resistance to blind brute-force guessing. It says nothing about whether the exact password already appears in a leaked-password database, in which case entropy is irrelevant, it just gets tried directly. See the entropy guide below for why that matters.
Why doesn't this tool tell me if my password is 'good enough'?
It reports the number, not a pass/fail judgment, because 'good enough' depends entirely on what the password protects. A rough guide: under 40 bits is weak, around 60 is a reasonable floor for a low-value account, 80 and up is the range to aim for on anything that matters, including your password manager.

Want the full derivation of this formula, with worked examples? Read password entropy explained. Need a password with a specific bit count instead of checking one you already have? Use Password Generator.