Password Entropy Calculator

Separate mathematical random-source entropy from real-world user-choice risk, find predictable patterns locally, model guess rates, and check modern password-policy guidance without uploading your password.

Runs locally · secrets are not uploaded

Password / passphrase

Never uploaded

Value to analyze

How was it created?

Primary guess rate

For human-chosen passwords, “entropy” is not directly measurable from the text. OneFreePlace therefore shows the uniform-random ceiling separately from a conservative pattern-aware estimate.

Strength analysis

—

Strength score

—

Characters—

UTF-8 bytes—

Random ceiling—

Pattern estimate—

What the analyzer found

Guess-rate scenarios

Scenario	Rate	Pattern estimate	Uniform-random ceiling

These are mathematical scenarios, not predictions. Real cracking speed depends heavily on the password hashing algorithm, its cost settings, attacker hardware, leaks, dictionaries and targeted information.

Custom rate calculator

Guesses per second

Expected midpoint time—

Expected midpoint assumes half the search space on average. It is only meaningful when the underlying guess-space estimate is meaningful.

Modern policy checks

Authentication context

Composition rules

Character-space diagnostics

Detected classes

—

Naive pool size

—

Distinct characters

—

Normalization

Analyzed exactly as typed; Unicode is not silently normalized.

What “entropy” means here

Random-source ceiling: length × log₂(character pool) assumes each character was independently and uniformly selected. That is appropriate for CSPRNG-generated strings, not ordinary human choices.

Pattern-aware estimate: a deliberately conservative local heuristic that discounts common words, sequences, repeats, dates, keyboard walks and predictable substitutions. It is useful for feedback, but it is not a guarantee or a substitute for a breached-password blocklist.

Current guidance

Length mattersCurrent NIST guidance emphasizes minimum length and blocklisting rather than forced composition rules.

Use unique generated passwordsPassword managers can create random credentials that make the mathematical entropy model much more meaningful.

Do not reuse credentialsA high-scoring password reused across sites is still vulnerable to credential stuffing after one breach.