All posts
Measuring Password Strength with Entropy and Checking Known Breaches
August 15, 2026 · DevTools
security
passwords
entropy
breach-check
Modern authentication systems require robust password verification that evaluates true mathematical entropy and verifies credentials against known leaked databases.
Audit passwords securely:
- Measure entropy and crack resistance with the Password Strength Checker
- Verify if a password was exposed in breaches via Password Breach Checker
Calculating Password Entropy
Entropy is measured in bits:
$$E = L \times \log_2(R)$$
- $L$ = Length of the password
- $R$ = Size of the character pool (e.g. 26 lowercase, 52 mixed case, 62 alphanumeric, 94 with symbols)
| Bits of Entropy | Strength Rating | Time to Crack (Brute Force) |
|---|---|---|
| < 28 bits | Very Weak | Instant |
| 28 – 35 bits | Weak | Seconds to Minutes |
| 36 – 59 bits | Reasonable | Days to Months |
| 60 – 127 bits | Strong | Decades to Centuries |
| 128+ bits | Very Strong | Unbreakable with current compute |
How k-Anonymity Protects Breach Checks
The Password Breach Checker never sends your password over the network. It calculates the SHA-1 hash client-side, sends only the first 5 hex characters to Have I Been Pwned, and checks the remaining hash suffix locally against returned candidates.