Password strength checker

Analyze password strength and estimated crack time.

Length	0
Character types	-
Estimated entropy	0 bit
Estimated brute-force time	-

Your input is processed only in the browser and never transmitted. Estimates are for reference only.

A signup form tells you your password is "strong" the moment you add a capital letter and an exclamation mark, which tells you almost nothing. This checker gives you the actual arithmetic instead — how large the character pool is, how many bits of entropy that works out to, and what that means in guessing time. Nothing you type leaves the browser.

How it works

How the numbers are produced

Type into the field and the four readouts update live. Length is the character count, Character types shows which classes you used, and Estimated entropy applies the standard formula: entropy in bits equals length multiplied by the base-2 logarithm of the pool size.

Characters used	Pool size	Bits per character
Lowercase only	26	~4.7
Upper + lower	52	~5.7
Upper + lower + digits	62	~5.95
Plus punctuation	~94	~6.55

Every extra bit doubles the number of guesses required, so the gap between 50 and 60 bits is roughly a thousandfold, not twenty percent.

Reading the crack time

Estimated brute-force time converts that entropy into a duration at an assumed guessing rate. Read it as a ceiling, not a forecast. Real attackers do not start at "aaaa" — they run leaked-password lists, dictionaries and predictable substitutions first, so a password like Summer2026! falls far faster than its bit score suggests.

What actually moves the needle

Length beats complexity. Adding one character multiplies the search space by the whole pool size; swapping a for @ adds almost nothing, because every cracking tool has tried that since the 1990s. Four or five unrelated words make a long password that is easy to remember and hard to guess.

The Hide toggle masks the field while you work. The checker runs entirely in your browser and transmits nothing, but it is still sound practice not to paste a password you are actively using into any web page.

Terms explained

Entropy (bits): A measure of unpredictability. Each additional bit doubles the number of guesses an attacker must make, so 70 bits is about a million times harder than 50.
Character set (pool): The range of symbols the password draws from — 26 for lowercase alone, 62 once you mix cases and digits, roughly 94 with punctuation.
Brute force: Trying every possible combination in sequence. It is the slowest possible attack, which is why the estimate here is an upper bound.
Dictionary attack: Guessing real words, names, dates and previously leaked passwords first. This is the attack that beats most human-chosen passwords.
Passphrase: Several unrelated words joined together. The smaller character set is more than offset by the length, and it is far easier to remember.

Frequently asked questions

Is my password sent anywhere?

No. The analysis runs in JavaScript in your browser and nothing is transmitted or stored, as the notice under the results states. Even so, it is better practice to test a variation than a password you currently rely on.

How long should a password be?

Length matters more than symbol variety. Twelve characters is a reasonable floor for ordinary accounts, and sixteen or more with mixed character types puts blind brute force out of practical reach with today's hardware.

Why does a weak-looking password still show a long crack time?

The estimate assumes an attacker guessing blindly with no prior knowledge. In reality, cracking starts from leaked password lists and dictionary words, so anything predictable can fall in seconds regardless of the score. Treat the figure as a theoretical maximum.

Does a high score mean my account is safe?

Not by itself. A password reused across sites is compromised the moment any one of those sites is breached, however complex it is. Unique passwords per site and two-factor authentication matter more than squeezing out extra bits.

Do character substitutions like @ for a help?

Barely. Those swaps are built into every mainstream cracking ruleset, so they add a fraction of a bit while making the password harder to type. Adding length or another word is far more effective.