Password entropy, made visible
“Use a strong password” is good advice and useless advice at the same time. What
does strong actually mean? Length helps, but Password1! is eleven characters
and still terrible. Entropy helps, but raw bit counts do not tell you that
correcthorsebatterystaple beats Tr0ub4dor&3 until something like zxcvbn
explains the patterns.
The gap is visualization. Security teams talk in bits and crack times. Users pick pet names with a digit on the end. A good tool bridges that gap: show the math, show the patterns, and make the tradeoffs tangible.
Assumes offline attack at 10,000 guesses/sec (slow hash).
Use the analyzer to type or paste a password and watch the crack-time meter respond. Switch to the diceware tab when you need a passphrase instead of a memorized string of symbols. Source at lab-pw-entropy.
Entropy vs pattern matching
| Approach | What it measures | Blind spots |
|---|---|---|
| Charset entropy | Bits from length × character pool size | Treats aaaaaaaa like random noise |
| zxcvbn | Dictionary words, keyboard walks, repeats | Heavier, English-centric |
| Diceware | log₂(7776^words) for unbiased word picks | Longer to type, very strong |
Charset entropy answers “how big is the search space if every character were random?” zxcvbn answers “how hard is this specific string to guess in the real world?” Both numbers belong on the same screen.
When to reach for it
- Sanity-checking a password policy before you roll it out
- Explaining to someone why
Summer2024!is not clever - Generating a diceware passphrase for a password manager master secret
- Comparing a random string against a six-word passphrase
This is a teaching and sketching tool, not a breach checker. For that, pair it with a k-anonymity lookup like Have I Been Pwned when you are ready to ask whether a password has already leaked.