Passwords
Measure a password's real entropy, estimate how long it survives an offline attack, and build a passphrase instead.
Nothing typed here leaves the tab. There is no request to make — the whole estimate runs on this page.
- "summer" is #70 on the list of the most common passwords.
- "2024" is a year, and years are near the front of every wordlist.
- A capital at the front and a digit or symbol on the end is the single most predicted password shape there is. It buys almost nothing.
Waiting for the browser to hand over a random source.
The naive figure is length × log2(charset), which assumes you rolled dice. The effective figure is what survives once the predictable parts are priced at what they actually cost: 300 of the most common passwords, 512 common words, keyboard runs, character sequences, repeats, dates, l33t swaps, and the capital-in-front digit-on-the-end shape. This is a heuristic, not zxcvbn — its lists are small, so it will miss a surname or a band name and read high. Take the number as a ceiling. The passphrase below is the opposite kind of claim: it is drawn uniformly from 512 words with rejection sampling, so its bits are exact rather than estimated. Measuring one above will read a little higher, because the meter also charges an attacker for guessing which joiner you used.
Password strength meters usually score patterns rather than resistance. Substituting a zero for an o adds almost nothing against an attacker with a rulebook, but it often turns a meter green.
This works in bits of entropy and shows the estimated crack time against fast offline hashing, which is the threat that matters when a database leaks. The passphrase generator produces the alternative: several random words, far stronger and far easier to type.
What people open it for
- Finding out whether a password is actually strong or just looks it
- Generating a memorable passphrase with real entropy
- Explaining why length beats character substitution
In the terminal
tools entropy
Every utility is also a command in the desktop's shell.