UTILS.
100% in-browser
📉

Shannon Entropy Calculator

Measure the Shannon entropy of text in bits per character and total bits, with distinct-symbol counts and a charset-pool password-strength estimate.

About this tool

The Shannon Entropy Calculator measures the information content of text. It builds a frequency map over the exact characters you enter, computes each symbol's probability p = count / length, and evaluates the Shannon formula H = −Σ p·log2(p) in bits per character. Multiplying by the length gives the total information in bits. It also reports the number of distinct symbols and the theoretical maximum entropy log2(distinct), which the actual entropy approaches only when every symbol is equally likely.

This actual (observed) entropy is distinct from a password-strength estimate, so the tool computes both. For the strength side it uses the charset-pool model: it detects which character classes are present — lowercase (26), uppercase (26), digits (10), common symbols (32), space (1), and other (100) — sums the pool size P, and reports pool entropy = length · log2(P) bits. A qualitative label follows the usual bands: under 28 bits is very weak, 28–35 weak, 36–59 reasonable, 60–127 strong, and 128+ very strong.

All logarithms use log2(x) = Math.log(x) / Math.LN2, and every calculation runs locally in your browser — nothing you type is stored or transmitted. Note the two numbers answer different questions: observed entropy tells you how unpredictable this specific string is given its own character distribution, while pool entropy estimates how hard the string would be to brute-force assuming each position is drawn uniformly from the detected character pool.

Frequently asked questions

What is the difference between the two entropy numbers?
Bits-per-character is the observed Shannon entropy of your exact text — how unpredictable the next character is given the string's own symbol frequencies. Pool bits is a brute-force strength estimate: length × log2(pool size), assuming each position is uniformly drawn from the detected character classes.
How is the character pool size determined?
The tool detects which classes appear and sums their sizes: lowercase 26, uppercase 26, digits 10, common ASCII symbols 32, space 1, and any other character 100. A password like ‘aB3’ uses lowercase + uppercase + digits, giving a pool of 62.
What do the strength labels mean?
They come from the pool-based bit count: under 28 bits very weak, 28–35 weak, 36–59 reasonable, 60–127 strong, and 128 or more very strong. These are common rule-of-thumb thresholds for brute-force resistance, not a guarantee against dictionary attacks.
Is my input stored or sent anywhere?
No. The frequency map, entropy, and pool estimate are all computed in your browser with plain JavaScript. Nothing you type is saved or transmitted, so you can safely test real passwords or sensitive text.

More tools