Token Strength Estimator

Token strength is a different question from password strength

A password is chosen by a person, so measuring it means guessing how predictable that choice was: dictionary words, substitutions, keyboard patterns. A token is generated by a machine, so if it came from a proper random number generator its strength is simply its length times the log of its alphabet, and no pattern analysis is needed or useful. That makes the calculation exact and the assumption everything. This tool states the assumption plainly rather than presenting an upper bound as though it were a measurement.

Fixed prefixes carry no entropy

Modern credentials advertise what they are: a GitHub token starts ghp_, a Stripe secret key sk_live_, an AWS access key AKIA. Those prefixes exist so that leaked credentials can be detected by scanning, and they are identical in every token of that type. A strength meter that counts the whole string therefore overstates every prefixed token, sometimes by twenty bits or more. This tool identifies the prefix, excludes it, and says how much it would have added if counted.

The alphabet is an assumption, so assume downward

A token is a string of characters, and how much entropy each character carries depends on the alphabet the generator drew from. That is not visible in the output: a thirty-two character string of hex digits looks identical whether it came from a hex generator or from a base62 generator that happened to avoid the other characters. This tool assumes the smallest alphabet that could have produced what it can see, which can only understate strength. Assuming a wider one would overstate it, and a security tool that errs optimistically is worse than one that errs the other way. Override it when you know the generator.

Length is rarely what actually protects a token

The time-to-guess figures assume an attacker can test candidates at the stated rate, and for a remote API that rate is set by the service rather than by arithmetic. A sixty-bit token behind strict rate limiting can outlast a hundred-and-twenty-eight-bit one that was committed to a public repository. Entropy is a floor worth clearing, not the thing that usually fails: most credential compromises are disclosures, not guesses.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.