Password Strength Checker

The password strength checker estimates how hard your password would be to crack. It calculates entropy (the real measure of password strength), estimates crack time against a realistic offline attack, checks the character composition, and flags specific weaknesses like common passwords, keyboard patterns, and sequences. Everything runs in your browser — your password is never sent anywhere.

Entropy measures unpredictability, in bits. It's calculated from two things: the size of the character pool you drew from, and the length of the password.

entropy = length × log2(pool size)

Each bit of entropy doubles the number of guesses an attacker needs. A few rough benchmarks:

• Under 28 bits: very weak — cracked instantly
• 28-40 bits: weak — minutes to hours
• 40-60 bits: fair — days to years
• 60-80 bits: strong — centuries
• 80+ bits: very strong — effectively uncrackable by brute force

The classic advice — "use a symbol, a number, an uppercase letter" — is less important than people think. Length matters far more.

Consider two passwords:

• P@ss1! — 6 characters, all four types, ~39 bits of entropy. Cracked in minutes.
• correct horse battery staple — 28 characters of lowercase words, ~100+ bits. Effectively uncrackable.

Each additional character multiplies the possibilities by the pool size. Adding length compounds much faster than adding one symbol. This is why passphrases — several random words strung together — are both stronger and easier to remember than short complex passwords.

The estimate assumes an offline attack: an attacker has stolen a database of password hashes and is trying to reverse them on their own hardware. We assume 10 billion guesses per second, a realistic rate for a modern GPU against a fast hash like unsalted SHA-1 or MD5.

The time shown is roughly how long it takes to try half the possible combinations (the average case for finding a specific password). For online attacks (guessing against a live login), rate limiting makes cracking vastly slower — but you should always assume the offline scenario, because data breaches happen constantly.

• Use at least 12 characters — 16 or more is much better
• Prefer a passphrase of random words over a short complex string
• Make every account's password unique — reuse is the biggest real-world risk
• Use a password manager to generate and store long random passwords
• Turn on two-factor authentication (2FA) wherever possible — it protects you even if a password leaks
• Never reuse your email password anywhere else

Is it safe to type my real password here?

Yes — but a healthy habit is to never type a real password into any website you don't fully trust. This tool runs entirely in your browser with zero network requests, which you can verify in developer tools. If you're cautious, test a password with the same length and character pattern rather than the exact one.

How long should my password be?

At least 12 characters; 16+ for important accounts (email, banking, password manager). For a passphrase, aim for 4-5 random words. Length is the most reliable lever for strength.

Are special characters required?

They help by enlarging the character pool, but they matter less than length. A long passphrase without symbols can be far stronger than a short password with them. Add symbols if the site requires them, but don't rely on them as your main defense.

What is two-factor authentication?

A second proof of identity beyond your password — a code from an app, a hardware key, or a biometric. Even if your password leaks, an attacker can't log in without the second factor. Turn it on for every important account.

Should I change passwords regularly?

Modern guidance (including NIST) says no — forced periodic changes lead people to weak, predictable patterns. Instead, use a strong unique password per site and only change it if there's a known breach. A password manager makes this effortless.

What's the safest way to store passwords?

A reputable password manager (Bitwarden, 1Password, KeePass). It generates long random unique passwords, stores them encrypted, and fills them automatically. You only memorize one strong master password. Never store passwords in a plain text file or reuse them across sites.