Enrichment · Passion Projects · Cybersecurity

Six random words
outlast eight
scrambled symbols.

Describe how a password is made: the pool it is picked from and how many picks. The calculator gives its strength in bits and how long, on average, a guessing attack would take.

Compare recipesWhat you get

The entropy calculator

The worked example compares four made-up recipes against a stolen password file. You never type a real password here, and nothing you type leaves this browser.

Loading the calculator. If nothing appears, turn on JavaScript.

What you get

Enrichment · Passion ProjectsFree

What you finish with
For each password recipe, its entropy in bits, how many possibilities it has and the average time to guess it, with the weak ones flagged. It prints as a summary and downloads as a spreadsheet.
Who it is for
Students learning cybersecurity or logarithms, computer science classes, and families choosing a master password for a password manager.
Format
Browser calculator for a phone, tablet or computer, by touch or keyboard. Up to 12 recipes. Prints a summary; downloads a spreadsheet (.csv); export and import a file.
Access
Free. No account, no sign-in and nothing to install. Everything you type stays in this browser; nothing is sent to Caveat.
Where it lives
The Passion Projects space in Caveat Enrichment.
Support
Questions, a correction or a request: team@caveatacademic.com.

How to use it

  1. Choose the attacker's guessing speed.
  2. Add each recipe: the pool (word list or characters), its size and how many are picked.
  3. Read the bits and the average time to guess.
  4. Add a word or a character to a weak recipe and watch the bits climb.
  5. Print the comparison for a class or a family talk.

Compare recipes

How the strength is worked out

Bits are a count of equally likely choices.

The worked example: six dice wordsSix dice words7,776 ^ 6five dice pick each wordBits77.56 × log₂ 7,776Half the space2^76.5average guesses neededAt 10 billion a second350,270 yearsaverage time to guessThe worked example: six dice wordsSix dice words7,776 ^ 6five dice pick each wordBits77.56 × log₂ 7,776Half the space2^76.5average guesses neededAt 10 billion a second350,270 yearsaverage time to guess
Strength comes from how many equally likely choices there were, not from how the result looks. Six random words beat eight random symbols.

The arithmetic

Picking L items at random from a pool of N gives N^L possibilities, which is L × log₂ N bits. Each bit doubles the work. An attacker who tries every possibility finds the right one, on average, halfway through, so the average time is 2^(bits − 1) ÷ guesses per second. The three speeds are round illustrative figures: a stolen file protected by a fast hash, by a deliberately slow one such as bcrypt, and a login that limits attempts.

What the number cannot see

The calculation assumes a computer or dice did the picking. People pick predictably: a favourite lyric, a pet's name with a year, letters swapped for look-alike numbers. Attackers try those first, so a made-up phrase is far weaker than its length. NIST's digital identity guidelines ask services to allow long passphrases, drop forced symbol rules and block passwords seen in breaches.

Sources

  1. National Institute of Standards and Technology. Digital Identity Guidelines: Authentication and Lifecycle Management, SP 800-63B (pages.nist.gov/800-63-4).
  2. Electronic Frontier Foundation. EFF Dice-Generated Passphrases: the large word list of 7,776 words and the short lists of 1,296 (eff.org/dice).
  3. Cybersecurity and Infrastructure Security Agency. Use strong passwords and a password manager (cisa.gov/secure-our-world).
  4. Shannon, C. E. (1948). A mathematical theory of communication. Bell System Technical Journal 27: entropy measured in bits.

The worked example is made up and the guessing speeds are illustrative. Never type a real password into any website to test it. Your recipes stay in this browser. Support: team@caveatacademic.com.