비밀번호 강도 & 엔트로피 계산기

계산 원리

Entropy here is length × log₂(pool size), the standard formula for a password drawn uniformly at random. The pool is assembled by adding a block for each character class the tool detects: 26 for lowercase, 26 for uppercase, 10 for digits, 33 for symbols, 1 for a space, and 100 for any non-ASCII Unicode character. The crack table then takes half the search space, 2^bits ÷ 2, and divides it by each attacker's guess rate.

Length moves the result far more than variety does, because it multiplies while an extra class only nudges a logarithm. The six attacker rows run from 10² guesses per second for a throttled online login up to 10¹⁴ for a nation-state ASIC, with the offline single-GPU row at 10¹⁰ — that middle figure is the realistic threat once a password database leaks. Ratings step from Very weak below 28 bits through Strong at 60 and Excellent at 80.

The uniform-randomness assumption is the big caveat. The formula cannot tell that a predictable string is guessed in seconds while a same-length random one is not, so anything a human chose scores far higher here than it deserves against a dictionary-and-rules attack. Passphrases are mismeasured the other way, since their real entropy comes from words selected rather than letters typed. Nothing leaves the page — the whole calculation runs in your browser.

자주 묻는 질문