Password Strength Checker
Estimate entropy and crack time for a password. Nothing is sent anywhere — the analysis runs entirely in your browser.
Entropy starts from the size of the character pool actually used, raised to the password's length. Penalties are then subtracted for structure a real cracker exploits — dictionary words, sequences, keyboard runs, repeats, and dates. Crack times assume half the keyspace is searched on average. Treat the result as a rough guide, not a guarantee: a targeted attacker who knows something about you does better than any of these numbers.
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The Password Strength Checker estimates how much work an attacker needs to guess a password. It starts from the entropy of the character pool the password actually uses, then subtracts bits for the structure crackers exploit first — common passwords, dictionary words with characters bolted on, sequences like 1234, keyboard runs like qwerty, repeated blocks, years, and the familiar Word + digits + symbol shape.
The result is shown as bits of entropy alongside estimated crack times across four attack scenarios, from a rate-limited login form to a GPU rig chewing through unsalted MD5. This is why a long passphrase usually outscores a short password that satisfies every complexity rule: length adds entropy faster than symbol variety does. Nothing you type is transmitted or stored — the whole analysis runs in your browser, and works with the network disconnected.
FAQ
No. The analysis runs entirely in your browser with JavaScript — nothing is uploaded, logged, or stored. You can confirm it by opening your browser's network tab, or by disconnecting from the internet and using the tool offline.
It is a measure of how many guesses an attacker needs. Each extra bit doubles that number, so a 60-bit password takes 1,024 times as long to crack as a 50-bit one. Roughly: under 36 bits is very weak, 60 is fair, and 80 or more is strong against offline attacks.
Length adds entropy faster than symbol variety does. "Password123!" satisfies every complexity rule but follows a pattern crackers try first, while four unrelated words are longer and unpredictable — which is why this tool usually scores the passphrase higher.
Raw entropy assumes every character is random. Real passwords are not, so bits are subtracted for common passwords, dictionary base words with characters bolted on, sequences like 1234, keyboard runs like qwerty, repeats, year patterns, and the Word+digits+symbol shape.
They are order-of-magnitude guides, not guarantees. They assume an attacker searches half the keyspace at a fixed guess rate for a given hash. A targeted attacker who knows your pet's name, or a site storing passwords badly, changes the picture entirely.
It is safe here because nothing leaves your browser, but as a habit it is better to test a password of the same shape than the real one — you cannot audit every site that offers this. Better still, let a password manager generate one and skip the guesswork.