Entropy Calculator
Measure the Shannon entropy and brute-force search space of a password or token in your browser.
- Runs locally in your browser
- No upload required
Try it
Supported formats
Privacy
Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.
The 28-character input has 13 distinct character(s), 97.85 bits of observed Shannon entropy and a 164.7-bit keyspace. Excellent: well beyond current brute-force reach for symmetric keys.
How it works
- Counted the characters and how often each appears.
- Computed the Shannon entropy per character as -Σ p·log2(p) and multiplied by the length for the observed total.
- Detected the alphabet from the character classes present.
- Computed the keyspace as length × log2(alphabetSize) and divided by a 10^9 guesses-per-second reference rate.
- The keyspace uses the alphabet size detected from the characters present, which assumes the string was drawn uniformly from exactly that set.
- Shannon entropy measures the observed distribution, not how the string was generated. A memorable phrase can score low per character yet still be hard to guess if it is long and random; a short string over many symbols can score high yet be guessable if it follows a pattern.
Methodology
- Count each distinct character and its frequency in the input.
- Compute the per-character Shannon entropy H = -Σ p·log2(p) and multiply by the length for the observed total.
- Detect the alphabet from the character classes present, or use the caller's declared size.
- Compute the keyspace as length × log2(alphabetSize) and divide by a labelled, illustrative guesses-per-second rate.
- State the assumptions and refuse to present the estimate as a guarantee about a real attacker.
Usage
- Paste the password or token you want to measure.
- Optionally declare the alphabet size used by the generator for a theoretical keyspace.
- Read the observed Shannon entropy and the keyspace estimate.
Examples
These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.
A four-word passphrase
{
"text": "correct horse battery staple"
}A short mixed-class password
{
"text": "P@ssw0rd"
}A 32-character base64url token
{
"text": "9fR2mQ7xL0pK3vT8sN1cZ4bY6wH5jD2a"
}A declared 62-symbol alphabet
{
"text": "aB3xY9zQ",
"alphabetSize": 62
}Limitations
Read the estimate with its assumptions
Entropy is not a property of a password in isolation; it is a property of the process that generated it. This tool shows both the observed Shannon entropy and the keyspace implied by an alphabet, and states which assumption each figure rests on, so the number is never presented as more certain than the input allows.
For a generated secret, prefer the generator's own entropy report, which knows the true pool size and draw process.
Frequently asked questions
- What is the difference between Shannon entropy and keyspace?
- Shannon entropy is computed from how often each character actually appears in the string. Keyspace assumes every position is an independent uniform draw over an alphabet of a given size. Keyspace is the relevant number for a random generator; Shannon entropy describes the observed data.
- Why does a passphrase score lower than a random string of the same length?
- Because letters repeat and the phrase uses a small alphabet, so per-character entropy is low. Length partly compensates, but a four-word passphrase is only strong if the words were chosen randomly from a large list, which a character-level calculator cannot see.
- Is my input sent anywhere?
- No. The string is measured in your browser and is never transmitted or stored.
Sources
Send feedback
Tell us if this tool helped, report a problem, or suggest a tool. Only the message you type is sent — never the input you used in the tool.
Was this tool useful?
Prefer to write to us directly? See the contact page.