Tukuk-OS🔐 Password Entropy
ℹ️ What this tool does & how it works
A strength bar is theatre; entropy in bits is arithmetic. The pool is the number of characters your set allows (26 lower, 62 mixed case, 95 printable, plus emoji if you like), the raw entropy is length × log₂(pool), and the discounts are what attackers actually exploit: a dictionary word contributes almost nothing, a keyboard run ("qwerty") almost nothing, a doubled word almost nothing. Crack time assumes an offline attacker with a rig doing 10¹⁰ guesses/second (the ballpark for bcrypt-fast GPU farms on an unsalted hash) — half the entropy-space on average, so divide by two.
How password lists actually get cracked
No attacker tries character-by-character. Rule engines (Hashcat, John) apply mutations to the million-password leak corpora that are already public — append digits, capitalise, leet-swap, double the word — which is why "Corr3ct-H0rse!" scores far below its raw entropy. The effective strength of a password is its rank in a human-behaviour distribution, not its length times its pool; this page approximates that with the three penalties every corpus study finds (dictionary membership, runs/patterns, template endings). The counterweight is random words from a diceware-style choice, where the entropy really is log₂(dictsize) per word because no human skill is involved in the picking — and where a 20-character password is easy to type, remember and read back over the phone.