Password strength checker
Estimate a password's entropy and how long it would take to crack — locally, with nothing sent anywhere.
Paste or type a password below to see a rough strength estimate: its entropy in bits and how long it might survive an offline cracking attempt. It runs entirely in your browser — the password never leaves your machine.
↳ Runs entirely in your browser. Nothing you type here is sent to us or anyone else.
What “strength” actually measures
Strength is really entropy — how unpredictable the password is, in bits. A password drawn from a larger set of possibilities, or that is longer, has more entropy, and each extra bit doubles the work an attacker faces. Length matters more than swapping a for @.
How this estimate works
The tool estimates the character pool (lowercase, uppercase, digits, symbols), multiplies by length to get raw bits, then applies light penalties for obvious repeats and common sequences. It is a heuristic, not a full dictionary model — a real attacker’s tooling (like hashcat with wordlists and rules) will crack a “clever” but common password far faster than the raw math suggests. Treat the number as a floor, not a guarantee.
Reading the crack-time
The estimate assumes a fast offline attack (~10 billion guesses/second, plausible for a leaked fast-hash database). Online attacks against a live login are far slower, but you should assume any password can eventually be tested offline if a service is breached — which is why uniqueness matters.
Getting a genuinely strong password
- Prefer a random passphrase or a password-manager-generated string.
- Make every password unique — reuse is the single biggest real-world risk.
- Favour length; aim for 60+ bits on anything that matters.
- Add two-factor authentication so a cracked password alone isn’t enough.