Two different numbers get called "entropy", and confusing them leads to bad decisions. This tool reports both and explains which one to act on.
Search space versus Shannon entropy
Search space is the number this tool leads with: alphabet size raised to the length, expressed in bits. It answers "how many values must an attacker try?" and assumes the value came from a uniform random source. For a machine-generated key, this is the correct measure.
Shannon entropy measures the character distribution of the specific string in front of you. It is shown because a large gap between the two is diagnostic: if a 20-character string has a 62-symbol alphabet but low observed entropy, it probably was not machine-generated.
Neither can detect meaning. Password123! scores about 71 bits of search space and would be cracked in seconds, because it is in every wordlist. Entropy maths assumes randomness; when a human chose the value, the assumption fails and the number is fiction.
Where the thresholds sit
| Bits | Assessment |
|---|---|
| Under 48 | Trivially brute-forced offline |
| 48–71 | Weak for anything live |
| 72–95 | Adequate, rotate frequently |
| 96–127 | Strong |
| 128+ | Beyond brute force, permanently |
The meter saturates at 128 bits deliberately. Past that point, additional bits change nothing about the real risk, and a progress bar that keeps growing implies otherwise.
Attacker rates, and which one applies
The tool shows five rates because the same secret can be strong or weak depending on where it is used:
- 10/s — online, rate limited. Your API with a per-key limit. Even 40 bits survives this.
- 10⁴/s — online, unthrottled. An endpoint with no rate limiting. This is the realistic threat to most API keys.
- 10⁹/s — offline, one GPU. A stolen database of fast hashes.
- 10¹² /s — offline, cluster. The default assumption for a leaked credential compared with a fast hash.
- 10¹⁵ /s — nation-state. Sets the 128-bit floor.
An API key stored as a SHA-256 hash and leaked faces the offline rates. A password stored with 600,000 PBKDF2 iterations faces something far slower — which is the entire point of key stretching.
Structural findings
Beyond the arithmetic, the tool flags patterns that make a value far weaker than its bit count suggests: character runs, keyboard sequences, dictionary words from credential lists, embedded years, and digits-only values. It also notes when a string looks like hex, because a 32-character hex string has a 16-symbol alphabet, not 36 — a distinction that halves the real entropy.
Frequently asked questions
My password scored 80 bits but the tool says it is weak. Why?
Look at the structural findings. If it contains a dictionary word, a year or a keyboard run, the search space figure is meaningless — an attacker uses a wordlist with mutation rules, not brute force, and reaches the value in seconds.
Is it safe to type a real password here?
Yes. The calculation is pure arithmetic in your browser, with no transmission and no storage. Load the page, go offline, and it still works.
What is a good target for an API key?
96 bits minimum, 128 or more preferred. The random key generator at 256 bits puts the question permanently out of reach for the cost of a slightly longer string.
Why does adding one character help so much?
Each added character multiplies the search space by the alphabet size. One more character from a 62-symbol alphabet makes brute force 62 times harder — which is why length beats complexity rules for human-chosen values.