All posts
Measuring Password Strength with Entropy and Checking Known Breaches
August 15, 2026 · DevTools
security
passwords
entropy
breach-check
Measuring Password Strength with Entropy and Checking Known Breaches
Modern authentication systems require robust password verification that evaluates true mathematical entropy and verifies credentials against known leaked databases.
Audit passwords securely:
- Measure entropy and crack resistance with the Password Strength Checker
- Verify if a password was exposed in breaches via Password Breach Checker
Calculating Password Entropy
Entropy is measured in bits:
$$E = L \times \log_2(R)$$
- $L$ = Length of the password
- $R$ = Size of the character pool (e.g. 26 lowercase, 52 mixed case, 62 alphanumeric, 94 with symbols)
| Bits of Entropy | Strength Rating | Time to Crack (Brute Force) |
|---|---|---|
| < 28 bits | Very Weak | Instant |
| 28 – 35 bits | Weak | Seconds to Minutes |
| 36 – 59 bits | Reasonable | Days to Months |
| 60 – 127 bits | Strong | Decades to Centuries |
| 128+ bits | Very Strong | Unbreakable with current compute |
How k-Anonymity Protects Breach Checks
The Password Breach Checker never sends your password over the network. It calculates the SHA-1 hash client-side, sends only the first 5 hex characters to Have I Been Pwned, and checks the remaining hash suffix locally against returned candidates.