usefulweb.site Password Entropy Race

Fun & games

Password Entropy Race

Race 2–6 passwords or passphrases: entropy, pattern penalties and crack times.

Between 2 and 6 lines, up to 128 characters each. Do not paste passwords you really use: use look-alikes with the same structure. With JavaScript on, the comparison runs in your browser only; without JavaScript (and via the API/MCP) the text is sent to the server, used for the calculation and not stored.

Try an example: Classic password vs passphrase · Keyboard walk vs random

How it works

Compares passwords and passphrases side by side: naive charset entropy, a pattern-aware estimate that penalises common passwords, keyboard walks, repeats, sequences, dates and l33t speak, and the average time to crack each one at four attacker speeds. With JavaScript on, everything runs in your browser and nothing is sent.

  • Charset entropy = length × log2(pool), where the pool adds 26 for lowercase, 26 for uppercase, 10 for digits, 33 for ASCII symbols/space and 100 for any other character used. This is the optimistic "brute force" number most meters show.
  • The pattern-aware estimate splits the password into the cheapest sequence of guessable pieces (dynamic programming, similar to zxcvbn but simpler): common passwords and words from a bundled list of about 600 entries (log2 of the rank, plus bits for capitalisation, reversal and each l33t substitution), other pronounceable letter runs (assumed to be in a 100,000-word attacker dictionary, about 16.6 bits), keyboard walks on QWERTY (start key, length and turns), repeats, alphabetical/numeric sequences, years 1900–2039 and calendar dates. Word separators (space, dash, underscore, dot) cost 2 bits; remaining characters cost log2(pool) each; combining k pieces (separators not counted) adds log2(k!) bits.
  • The reported entropy is the smaller of the two numbers. Crack time is the average (half the search space, 2^(bits−1) guesses) divided by the attacker speed: 100 guesses/hour (online, throttled), 10 guesses/s (online), 10⁴ guesses/s (offline, slow hash such as bcrypt) and 10¹⁰ guesses/s (offline, fast unsalted hash on GPUs) — the scenario speeds popularised by zxcvbn.
  • The race winner is the highest pattern-aware entropy; results within 1 bit count as a photo finish.
  • Privacy: the same JavaScript file runs in your browser (form submission is intercepted, nothing is sent) and on the server (only when JavaScript is off, or via the API/MCP). Results show passwords masked; detected pattern pieces are listed so you can see why a password is weak.

An estimate for comparison and learning, not a guarantee. Real attackers use lists with billions of leaked passwords and smarter rules; never reuse passwords and prefer a password manager.

Sources

For scripts and AI agents

  • JSON API: POST https://passwordentropyrace.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://passwordentropyrace.usefulweb.site/mcp · tool name password_entropy_race
Example request
curl -s -X POST https://passwordentropyrace.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"passwords":"P@ssw0rd2024\ncorrect horse battery staple\nTr0ub4dor&3"}'
Feedback