yigityalim
projectshandbookslabshireshare
xgithub
siteprojectshandbookslabschangelog
aboutusesnowhireshare
elsewherexgithublinkedinemail
metarssllms.txtsitemap
© 2026 Yiğit Yalım. All rights reserved.
/
Back to Labs
May 10, 2026·crypto

Password Entropy Meter

Compute password strength via Shannon entropy. Detect character classes, project crack time for four attacker profiles. Nothing leaves your browser.

password · entropy · security

PreviousJWT GeneratorNextRegex Tester

The intuition for "strong password" misleads. Tr0ub4dor&3 is weak; correct horse battery staple of four words is strong. Reason: entropy scales with character count × alphabet size, not with how scrambled it looks.

This lab applies the Shannon entropy formula (H=L⋅log⁡2∣Σ∣H = L \cdot \log_2 |\Sigma|H=L⋅log2​∣Σ∣) live and projects crack time for four attacker profiles.

EntropyMeter — tarayıcıda, hiçbir şey gönderilmez
very weak0.0 bit
0255075100+
a–z
0
A–Z
0
0–9
0
!@#
0
unicode
0
average crack time
offline · bcrypt (cost 12)instant
online (throttled)
instant
offline · bcrypt (cost 12)
instant
offline · PBKDF2-SHA256
instant
offline · MD5 (raw)
instant
offline · SHA-1 (raw)
instant
offline · NTLM
instant

bcrypt/Argon2 kullanan sistemlerde GPU saldırısı saniyede binlerle sınırlıdır. MD5/SHA-1 ile hash'lenmiş parolalar milyarlarca deneme/saniye ile kırılabilir.

generator · crypto.getRandomValues
uzunluk16

Modulo bias önlemi: cutoff = floor(2³²/N)×N, cutoff üstü değerler reddedilir. Fisher-Yates shuffle + zorunlu charset coverage.

What it teaches

  • Character class diversity widens the alphabet — adding uppercase brings 26 new symbols
  • Length beats class diversity — a 16-char lowercase password (H ≈ 75 bits) is stronger than an 8-char mixed one (H ≈ 53 bits)
  • Online rate-limited (100/s) vs offline GPU (100 GH/s) is 9 orders of magnitude apart — this is why a KDF like PBKDF2 or Argon2 that slows hashing 1000× also slows the offline attack
  • Computation never sends the password itself — runs in your browser, no telemetry

Caveats

The lab shows a "best case" entropy — assumes the password was chosen uniformly at random over its alphabet. Real passwords are not uniform — Password123! looks like 73 bits but is one of the first guesses in any wordlist; an actual attacker breaks it in seconds. Dictionary resistance is a separate axis (libraries like zxcvbn try to model it).

Practical takeaway: if you picked the password yourself it's weak; let a password manager generate it. 16+ chars, four classes, off-dictionary.