How to Calculate Password Entropy & Brute-Force Crack Time
Learn how information theory calculates password entropy bits using Hartley and Shannon formulas, and evaluate brute-force resistance across modern GPU threat models.
In-Browser Information Theory Calculation Pipeline
Files remain in local browser memory. Processing runs client-side.
1. Local Ingest
Your browser queries local file headers or byte structures directly using standard HTML5 File APIs.
2. Browser Processing
The data is loaded exclusively into your browser's isolated session memory (RAM).
3. Generated Output
Outputs (like compiled results or CSV logs) are written directly to your system download folder.
1. Information Theory Password Entropy (Bits)
Traditional password strength meters rely on crude, arbitrary rules (e.g. requiring at least one capital letter, one number, and one symbol). These checklists create a false sense of security, encouraging users to write predictable strings like "Password123!" that conform to rules while remaining trivially easy for automated attack tools to crack.
Combinatorial Search Space & Information Entropy Model
In computer science, true password strength is measured using Claude Shannon's mathematical concept of information entropy, quantified in logarithmic "bits". Each additional bit of entropy doubles the total number of guesses an attacker must attempt to guarantee cracking the credential.
2. Interactive Workspace Anatomy & Control Breakdown
Master every control, parameter slider, and export action in the interactive workspace:
Workspace Controls & Parameter Specification
Local keystroke evaluation field with instant show/hide visibility toggle and zero server transmission.
Audits presence of lowercase a-z (26), uppercase A-Z (26), digits 0-9 (10), and special symbols (33) to determine pool size R.
Calculates total information entropy in bits (E = L * log2(R)) with dynamic visual strength color meter.
Estimates crack duration across: Online web form (100 guesses/sec), Offline consumer GPU (10^10/sec), and GPU cluster (10^14/sec).
Classifies entropy score: Very Weak (under 28 bits), Weak (28-35), Reasonable (36-59), Strong (60-127), Cryptographically Strong (128+).
Copies a clean summary report containing entropy bits, pool composition, and crack times without revealing the plaintext password.
3. Hartley Cardinality vs Shannon Entropy
The tool calculates password strength using two complementary information theory formulations:
Hartley Combinatorial Entropy
Formula: E = L × log₂(R)
Where L is string length and R is character pool cardinality (e.g. 26 for lowercase, 62 for alphanumeric, 95 for printable ASCII). Measures the maximum theoretical search space assuming uniform randomness.
Shannon Informational Entropy
Formula: H = -Σ pᵢ log₂(pᵢ)
Where pᵢ is the empirical probability of character i. Quantifies symbol frequency redundancy, detecting when a password repeats characters (e.g. "aaaaa") even if the character pool is technically large.
4. Step-by-Step Entropy Analysis Walkthrough
Evaluate credentials locally without exposing private passphrases:
Input Credential or Token
Type or paste your password, API token, or passphrase string into the input panel.
Inspect Hartley & Shannon Metrics
Review calculated entropy bits, raw character pool cardinality, and Shannon redundancy density.
Review Pattern Penalties
Audit algorithmic deductions applied for character runs (123), repeats (aaa), or keyboard walks (qwerty).
Evaluate Threat Model Durations
Examine expected crack time across rate-limited web portals, bcrypt hashes, and 100B/sec GPU clusters.
What type of credential are you designing?
Select an option below to reveal our recommended pathway.
5. The 5 Threat Models: Web Logins to 100B GPU Rigs
Translating abstract entropy bits into realistic security requires modeling against specific attacker capabilities:
• Online Throttled (100 guesses/hour): Protected by web application rate limiting and CAPTCHA gates.
• Online Unthrottled (1,000 guesses/sec): Attacker hammering an exposed API endpoint lacking rate limits.
• Offline Slow Hash (10,000 guesses/sec): Attacker cracking a stolen database hash salted with bcrypt, scrypt, or Argon2.
• Offline Fast Hash (100 Billion guesses/sec): Modern 8x NVIDIA RTX 4090 GPU cluster attacking unsalted MD5, NTLM, or SHA-1 hashes.
6. Practical Workflows: Passphrases vs Complex Strings
Understand why length beats character complexity in modern credential engineering:
1. The Diceware Multi-Word Passphrase (Optimal for Humans)
A passphrase like "correct-horse-battery-staple" consists of 4 random words chosen from the standard EFF wordlist (7,776 words). Each word contributes log₂(7776) = 12.9 bits of entropy, giving a 4-word phrase ~52 bits and a 5-word phrase ~65 bits of pure, unpredictable entropy that is trivial to remember and type.
2. Random Alphanumeric Strings (Optimal for Machines)
For API tokens and database connection strings, a 20-character random string from a 62-character alphanumeric pool yields 20 × log₂(62) = 119.1 bits of entropy, rendering brute-force cracking completely impossible for the next several centuries.
7. Common Password Traps to Avoid
8. Understanding Pattern Penalties & Keyboard Walks
The SHRTX Entropy Calculator does not merely calculate naive length × pool size. It applies algorithmic pattern penalties:
Penalty Deductions
- • Consecutive Identical Repeats: Strings like "aaaa" receive heavy entropy deductions because subsequent identical characters add zero new search space information.
- • Sequential Number and Letter Runs: Sequences like "12345" or "abcdef" are penalized by up to 80% because automated attack tools test sequential ranges first.
- • Low Shannon Informational Density: If a 20-character string uses only 2 unique characters, Shannon entropy flags the severe structural repetition.
9. Client-Side Cryptographic Isolation & Zero Telemetry
Typing an active personal password or API token into an online web form is dangerous if that website sends keystrokes or analytics payloads to central cloud servers.
The SHRTX Entropy Calculator evaluates credentials 100% locally in your device's volatile RAM. Zero keystrokes are recorded, zero input strings are transmitted over the network, and zero credential data is logged to analytics or third-party cookies. When you close the browser tab, the string is completely purged from memory.
10. Pre-Flight Credential Security Checklist
Verify these items before deploying a new password or secret key:
Password Entropy Pre-Flight Checklist
Complete these checks before sharing or uploading your files.