Public Security Tooling

Password Strength Analyzer

Entropy-based password analysis with breach detection — goes beyond character count rules to measure actual password strength.

PythonJavaScript Shannon EntropyHTML/CSS

View on GitHub →

The Problem with Standard Password Rules

"Must contain uppercase, lowercase, number, and special character" — this rule produces passwords like Password1! which scores 100% on most strength meters but is in every breach database and cracked in seconds. Character class rules measure compliance, not entropy.

This analyzer measures what actually matters: the unpredictability of the password, expressed as Shannon entropy in bits.

Shannon Entropy

Shannon entropy measures the average information content per character. A password with high entropy is harder to predict and crack — regardless of whether it has a capital letter or not.

import math
from collections import Counter

def shannon_entropy(password):
    freq = Counter(password)
    length = len(password)
    return -sum(
        (count/length) * math.log2(count/length)
        for count in freq.values()
    )

# "aaaaaaaaaa" → 0.0 bits  (completely predictable)
# "Password1!" → 2.85 bits (low entropy despite meeting rules)
# "k9#mQ2$xL8" → 3.32 bits (high entropy, actually strong)

Analysis Layers

Layer	What It Checks	Why It Matters
Entropy scoring	Shannon entropy in bits, character set size, effective keyspace	Actual mathematical measure of cracking difficulty
Pattern detection	Keyboard walks (qwerty), date patterns, repeated sequences, L33tspeak substitutions	Patterns reduce effective entropy — P@ssw0rd is not random
Breach detection	Cross-references against breach database of known compromised passwords	A mathematically strong password that's in HaveIBeenPwned is worthless
Complexity checks	Length, character classes, uniqueness ratio	Baseline hygiene — long passwords with unique characters have larger keyspace