Entropy calculator
The real entropy of a randomly generated value, corrected for the constraints that most calculators ignore.
This calculator asks for the shape of a value, never for the value itself. There is no field to paste a password into, and there would be no point, because entropy is a property of how something was generated and not of the string that came out.
Why the usual formula is wrong when you add rules
The figure every calculator prints is L x log2(N):
length times the log base two of the alphabet size. That is correct only
when every character is chosen independently and uniformly. Three common
options break that assumption, and each makes the true entropy
lower than the printed number.
Requiring at least one character from each class forbids every string that lacks one, so there are fewer possible outputs. The correct entropy is the log base two of how many valid strings exist, which this calculator counts by inclusion-exclusion over the classes rather than approximating. Excluding look-alike characters shrinks the alphabet, which is easy to account for but is usually reported against the original alphabet anyway. Forbidding repeats means later positions draw from a smaller pool, so the entropy is the sum of the logs of a shrinking range rather than a constant per character.
None of these effects is large enough to make a well-chosen configuration insecure. They are worth showing because a tool that reports a number it knows to be wrong has told you something about its other numbers too.
What the bits actually buy
Entropy measures resistance to guessing, and only that. It says nothing about how the value is stored, and storage is usually what decides the outcome. Sixty bits behind Argon2id is a genuinely hard problem. The same sixty bits behind unsalted MD5 is not, because the attacker gets billions of guesses per second per GPU rather than a handful.
For a value an attacker can only try against a rate-limited endpoint, 64 bits is comfortable. For anything that could be captured and attacked offline, 112 bits or more is the target, which nineteen alphanumeric characters reaches. Past about 128 bits, extra length buys nothing against brute force and the entire risk sits in how the value is handled.