Entropy of a String Calculator
Measure the Shannon entropy of any text in bits per character with H = - sum of p times log2(p), then read the total information content, redundancy against the maximum possible entropy, and a password search-space strength estimate all in one place.
🔐Choose a Mode
🎯Try a Sample String
📝String Inputs
Every character counts. Frequencies are read exactly as typed.
Uncheck to fold uppercase into lowercase before counting.
Uncheck to strip spaces, tabs, and newlines from the string.
Auto adds 26 lower, 26 upper, 10 digits, 32 symbols as found.
Only used when the mode above is set to manual.
Sets the crack-time estimate for the password entropy card.
Controls rounding on entropy and information values.
Lists each distinct character, its p, and -p log2 p term.
🔢Formula Snapshot
📊Entropy by Character Distribution
| Distribution | Example | Distinct k | H (bits/char) | Meaning |
|---|---|---|---|---|
| Single character | aaaaaa | 1 | 0.00 | No uncertainty |
| Two, equal | ababab | 2 | 1.00 | One coin flip each |
| Two, skewed 3:1 | aaab | 2 | 0.81 | Bias lowers H |
| Four, equal | abcdabcd | 4 | 2.00 | log2(4) = 2 |
| Eight, equal | abcdefgh | 8 | 3.00 | log2(8) = 3 |
| 10 digits, equal | 0123456789 | 10 | 3.32 | log2(10) |
| 26 letters, equal | abc...xyz | 26 | 4.70 | log2(26) |
| English prose | typical text | ~27 | ~4.00 | Real-world value |
🔗Character Class Pool Sizes
| Character Class | Pool N | Bits per Char | Example Symbols |
|---|---|---|---|
| Lowercase only | 26 | 4.70 | a b c ... z |
| Uppercase only | 26 | 4.70 | A B C ... Z |
| Digits only | 10 | 3.32 | 0 1 2 ... 9 |
| Lower + digits | 36 | 5.17 | a-z 0-9 |
| Lower + upper | 52 | 5.70 | a-z A-Z |
| Alphanumeric | 62 | 5.95 | a-z A-Z 0-9 |
| + symbols | 94 | 6.55 | full printable ASCII |
| Hex digits | 16 | 4.00 | 0-9 a-f |
🗄String Entropy Comparison Grid
| String / Type | Length | Distinct | H (bits/char) | Total bits | Rating |
|---|---|---|---|---|---|
| aaaa | 4 | 1 | 0.00 | 0.00 | None |
| 1234 | 4 | 4 | 2.00 | 8.00 | Very weak |
| abcd | 4 | 4 | 2.00 | 8.00 | Very weak |
| password | 8 | 7 | 2.75 | 22.0 | Weak |
| mississippi | 11 | 4 | 1.82 | 20.0 | Low |
| Tr0ub4dor&3 | 11 | 10 | 3.28 | 36.1 | Fair |
| Hex 16 char | 16 | 16 | 4.00 | 64.0 | Good |
| Random 16 mix | 16 | 16 | 4.00 | 64.0 | Strong |
| 4 word passphrase | 28 | ~15 | ~3.90 | ~109 | Strong |
🔓Password Entropy and Crack Time
| Entropy (bits) | Strength Tier | Combinations | At 1 Trillion / s |
|---|---|---|---|
| Under 28 | Very weak | Under 268 million | Instant |
| 28 to 35 | Weak | Billions | Seconds |
| 36 to 59 | Fair | Trillions | Minutes to days |
| 60 to 79 | Strong | Quintillions | Years |
| 80 to 99 | Very strong | 10^24 plus | Millennia |
| 100 to 127 | Excellent | 10^30 plus | Cosmic |
| 128 and up | Cryptographic | 10^38 plus | Infeasible |
⚙Formula Breakdown
💡Practical Entropy Tips
For example, you’d think that a lengthy password must be safe… but according to concept of entropy, it isn’t. If all 12 characters is the same letter, we know exactly what each one will be. There is no uncertainty, which means there are 0 bits of actualy information. This makes it less secure and also compresses well.
The page has a calculator that measure that randomness (based off Claude Shannon’s original 1948 formula). It will tell you how many bits of actual info your text contain, and how many are simply predictable noise. It all comes back to Shannon entropy, the sum (technically, the negative sum) of the base-two logarithm of each character’s probability times that probability itself.
How Entropy Measures Password Randomness
Entropy is average surprise. For a given alphabet size, the entropy will be highest when each character have an equal chance of appearing; that’s as surprising as possible. But something like abab is perfect alternating. It has an entropy of one bit per character. Each position resolve the uncertainty of a single fair coin flip. Skew that probability really far towards one letter and the entropy decrease.
Plug your text into the calculator above and it do the math for you (no more having to look up logs yourself). It even shows you what characters is pulling the score down.
So why do security audits goes wrong? Most people mix up two distinct form of entropy. Shannon entropy examines the string you typed, looking for patterns by measuring how often each character occur; this tells us how compressible your string is. But what matters for password strength isn’t Shannon entropy; rather, it’s search-space entropy, which takes into account that the attacker doesn’t know your string, they need to guess one out of a set of possible strings.
And here, too, the tool makes a clear distinction. It estimates the effort required of a hacker who want to bruteforce his or her way in. It also calculates the theoretical minimum number of bits that would of been required to encode your string exactly. Take, for instance, the old standby Tr0ub4dor and 3. That’s not simple to look at… Symbols, numbers, and mixed case. With that many characters, drawing from a pool of 94 possible ASCII ones, it has a lot of search-space entropy. But it isn’t too much in terms of randomness; it can be guessed based on human patterns. Despite having a high bit count due to both length and character variety, it gets cracked immediately by a dictionary attack.
The discrepancy is what makes long random passphrases so good compared to short complex passwords. Extra length exponentially raises your security; extra weird characters just add a little more to the pool.
Another interesting perspective, perhaps of particular interest to data engineers, is the redundancy metric. This metric measures how close your string’s true entropy match its highest potential entropy based on its unique collection of characters. If it’s very high, the text is predictable, hence easily compressed. Typical English writing have a lot of redundancy (this is why gzip does so well). A uniformly random string will have nearly zero redundancy and won’t budge an inch. One number, one percent, tells you how much headroom there is for any compression algorithm to make things smaller without reaching theoretical limits.
The inputs can change to match your requirements. Case sensitivity is toggled on/off. This increases the size of alphabet, so that A and a become separate symbols, increasing the entropy if both are included. Whitespace stripping take out any obvious padding that tends to reduce the score of shorter strings. Password mode allows you to specify your own character set by hand (useful for things like base-16 tokens, or base-64 passwords that don’t match regular old ASCII).
To summarize: Entropy measures ignorance. It’s a way to quantify how predictable a pattern is. If the number of bits is small, then there is an obvious pattern. If the number of bits are large, well, you can’t guess that string. You can use this to check your homework or test your encryption keys. You can even use it just for fun if you’re curious what your favorite password might be. But don’t go by your gut, just enter your string, select your mode and read the bits. The answer won’t lie. Not even when your gut says otherwise.
