Shannon entropy measures how unpredictable a string is — the average number of bits of information per character. A string of all identical characters scores zero entropy (completely predictable), while a string where every character is equally likely scores maximum entropy for its character set. Higher entropy means an attacker needs exponentially more guesses to brute-force the string, making it a core metric for password strength evaluation.
This tool combines three signals: entropy (weighted at 50%), uniqueness — the ratio of distinct characters to total length (30%), and the inverse of repetition — how dominant the most frequent character is (20%). A string scores Strong when all three are favourable. Short strings or strings with many repeated characters score Weak regardless of how many character types they mix, because they still have low per-character entropy.
The scorer is also useful for comparing brand names and usernames. A name that scores high on uniqueness and low on repetition is more visually distinctive and memorable. Use it alongside the Brand Name Generator and Typo Generator to evaluate candidates — a name that is hard to mistype and scores well on uniqueness is a stronger choice than one that looks distinctive but generates many lookalike variants.
Frequently Asked Questions
What is Shannon entropy and why does it matter?+
Shannon entropy measures the average information (unpredictability) per character in bits. A string of all identical characters has entropy 0 — it is completely predictable. A string where every character is equally likely has the maximum entropy for its character set. Higher entropy means more information is packed into fewer characters, which translates to more guessing work for an attacker.
What makes a string score as "Strong"?+
The overall rating combines entropy (50%), uniqueness (30%), and the inverse of repetition (20%). A string scores Strong when its entropy is high relative to its character set, most characters are distinct (high uniqueness), and no single character dominates (low repetition). Short strings or strings with many repeated characters will score Weak regardless of mixing character types.
Is this a password strength meter?+
It measures statistical properties of strings, which correlates with password strength but is not a substitute for a dedicated password strength library (like zxcvbn) that checks against common password dictionaries. A random-looking string can still be weak if it matches a known pattern. Use this for comparing word, name, or username options, not as a security audit tool.
What is the charset size metric?+
Charset size is the theoretical pool of characters the string could draw from: 26 for lowercase letters, 26 more for uppercase, 10 for digits, and 32 for common symbols. A string that mixes all four character types has a charset of 94, meaning an attacker must try up to 94 possibilities per position. Larger charset → harder brute force.
Related Tools
How to use
- Type or paste any string — a password, username, or brand name — and click Score.
- Entropy measures unpredictability (Shannon entropy in bits). Higher is better.
- Repetition shows how often the most frequent character appears — lower is better.
- Uniqueness is the ratio of distinct characters to total length — higher is better.
- The verdict combines all three signals to give an overall strength rating.