Password Strength Checker
Entropy score, crack time estimate, and specific tips. Your password never leaves your browser.
How Password Strength is Calculated
Entropy (measured in bits) represents the number of guesses an attacker would need. It is calculated from the length of your password and the size of the character set used. A password using only lowercase letters has a character set of 26; adding uppercase gives 52; numbers brings it to 62; symbols push it to 94+.
Modern GPUs can test billions of password guesses per second. A 60-bit entropy password would take centuries even on specialised hardware — while a 30-bit password might fall in seconds.
What the Meter Doesn't Catch — Attack Vectors
Entropy-based meters are useful but incomplete. Real attackers use three strategies that raw entropy doesn't reflect:
- Dictionary & hybrid attacks. Attackers don't brute-force randomly — they start with billions of leaked passwords, common words, names, years, and keyboard patterns. A 14-character password built from a dictionary word + "2024" + "!" has high estimated entropy but near-zero real entropy against a hybrid attack.
- Credential stuffing. If you reuse a password, its strength is irrelevant — the attacker already has it from a breach. Uniqueness per site matters more than complexity.
- Phishing & malware. No amount of entropy protects a password entered on a fake login page or captured by a keylogger. That's why 2FA (especially hardware keys) is essential.
How the Target's Hash Changes Everything
The crack-time estimate here assumes a fast hash (MD5, SHA-1, NTLM) at 10 billion guesses/second. The actual time depends entirely on how the site stores passwords:
- Unsalted fast hash (MD5/SHA-1). The estimate here is roughly accurate. Trillions of guesses/second on GPU clusters.
- Salted fast hash (SHA-256 with salt). Salts prevent rainbow tables but don't slow GPU attacks much. Still billions/second.
- bcrypt / Argon2 / scrypt / PBKDF2. These are memory-hard or iteratively slow. A bcrypt cost factor of 12 reduces guess rate to thousands/second. A "Weak" password here might take years instead of seconds.
You usually can't control the site's hashing, so assume the worst (fast hash) and choose a password that survives it.
Passphrases vs Random Passwords
A passphrase — four or more truly random words like "correct horse battery staple" — often beats a shorter random string on both memorability and entropy:
- Four random words (Diceware). ~52 bits entropy, easily memorised.
- Five random words. ~65 bits — strong for most accounts.
- Six random words. ~78 bits — high security, still memorable.
The catch: passphrases only work if the words are genuinely random (use dice or a tool). Song lyrics, quotes, or "correct horse battery staple" itself are in every attacker's wordlist. If the site limits password length or bans spaces, a random password from a generator is better.
Password Strength in a 2FA World
A strong password + 2FA is the gold standard. Here's how they work together:
- Password stops credential stuffing. If your password is unique and strong, leaked credentials from other breaches don't work.
- 2FA stops phishing & stolen passwords. Even if an attacker gets your password (phishing, malware, shoulder surfing), they can't log in without the second factor.
- Hardware keys (FIDO2/WebAuthn) are best. They resist phishing completely because they verify the site domain cryptographically. TOTP codes can be phished; hardware keys cannot.
Think of password strength as the lock on your front door, and 2FA as the deadbolt. You need both — and a deadbolt that can't be picked remotely (hardware key) is the modern choice.
Frequently Asked Questions
Why does a word like "P@ssw0rd!" score well even though it is a known pattern?
The checker estimates entropy from length and the character types it detects, so patterned passwords built from dictionary words can score higher than their real-world risk justifies. If a password is recognisable to humans, attackers know it too — treat a great score as a lower bound, not a guarantee.
Does this tool check my password against known breaches?
No, and it cannot: for privacy reasons nothing here is sent to a server. To check whether a password or email appears in known breach data, visit a service like haveibeenpwned.com separately and never enter your real password there — checking via your password manager is safest.
Is the estimated crack time accurate?
It is an order-of-magnitude estimate. It assumes an offline attacker testing billions of guesses per second against a fast hash, which is a realistic worst case for unsalted MD5, SHA-1, or NTLM. Modern password hashes like bcrypt, Argon2 and scrypt slow attacks down dramatically, so real-world times are usually longer — treat the estimate as optimistic.
What score should I aim for?
Aim for Strong or Excellent with 20+ characters and mixed types. Anything below Fair is a sign your password would fall quickly in an offline attack. If your score is low, generate a new random password and switch to a password manager so you never need to remember it.
How to use the Password Strength Checker
- Type or paste the password to analyse. Use the eye button to temporarily show the text if you need to double-check what you entered. Because the analysis runs entirely in your browser, nothing you type is transmitted or stored anywhere.
- Read the strength label and bar. The result panel rates the password from Very Weak to Excellent and colours the bar accordingly. The rating is instant and updates as you type.
- Look at the two headline numbers. Length is shown as a character count, and entropy in bits. Together with the estimated crack time they tell you whether the password survives an offline brute-force attack measured in seconds or in centuries.
- Work through the improvement tips. Each suggestion targets a concrete weakness: add length, enlarge the character set, or remove repeated patterns. Fix the highest-impact item first — usually length.
- Act on the verdict. Weak passwords should be replaced rather than tweaked. Generate a fresh random password of 20+ characters and store it in a password manager.
How the score is calculated — and what it cannot see
This checker works the same way most strength meters do: it inspects which character types appear (lowercase, uppercase, digits, symbols), estimates the effective character set size from them, and multiplies that by the password length to estimate entropy in bits. The meter then maps that estimate onto a five-step scale, and the crack-time figure assumes an attacker able to test roughly ten billion guesses per second — a plausible speed for modern GPUs attacking an unsalted fast hash.
That model has an important blind spot: it treats every character as equally unpredictable. A password like dolphins2024 contains a dictionary word and a common number, so its true entropy is far below the estimate — attackers do not guess characters one by one, they try words, dates, years, and hundreds of millions of previously leaked passwords first. The meter cannot see that. Anything recognisable to a human is guessable by software, which is precisely why random generation beats human creativity.
The score also says nothing about whether the password has already been exposed in a data breach, whether you reuse it across sites, or whether the site protects it with modern hashing. A "strong" password that is reused on fifty sites is still a single point of failure — one breached forum reveals it everywhere. So use this meter as a quick first check, then complete the picture: a long random password, unique per site, stored in a password manager, protected by 2FA. That combination is what actually stops account takeover.