# How to convert zxcvbn entropy to score

I want to use zxcvbn-c but it gives the entropy number, not score like the javascript library does. How do I convert entropy number to a score? (0 to 4)

The zxcvbn blog/source mentions that the score is related to estimated cracktime. I think this will be relative and increasing over time as computers get more powerful. But whats the current recomended formula to convert entropy to cracktime? How can I calculate a score for now? When should I reevaluate?

Heres what I found but how to know what guesses is made from and how to make the formula?

``````0 = guesses < 10^3
1 = guesses < 10^6
2 = guesses < 10^8
3 = guesses < 10^10
4 = guesses >= 10^10
``````

• Each bit of entropy doubles the expected number of guesses an attacker will have to make, so without looking into it further I would assume you could compare `e < log2(10^n)` where `n` is 3, 6, 8, 10, etc. Feb 20, 2018 at 14:30
• The app also give a "log10" number which is really just entropy * 0.301029996 Feb 20, 2018 at 20:40
• Then compare entropy log10 against 3, 6, 8, 10. Same thing either way. Feb 20, 2018 at 20:55

Thanks @AndrolGenhald I think this is how the javascript works

``````log = e * 0.301029996;
if (log < 3) s = 0;
if (log < 6) s = 1;
if (log < 8) s = 2;
if (log < 10) s = 3;
if (log >= 10) s = 4;
``````