Password Strength & Time-to-Crack
Analyze your password's strength and see how long it would take to brute-force. Never sent to any server.
Your password is analyzed entirely in your browser. It is never sent to any server or stored anywhere.
About This Tool
The Password Strength Checker calculates the entropy of your password and estimates how long it would take to crack using a brute-force attack. Entropy is measured in bits, and each additional bit doubles the search space. The tool analyzes character set size, password length, common patterns, and dictionary words to give you a realistic strength score. Your password is analyzed entirely in your browser and never transmitted anywhere.
How to Use
- Type your password into the input field. The strength meter updates in real time as you type.
- Review the entropy score (bits), crack time estimate, and strength rating.
- Check the suggestions panel for specific improvements, such as adding symbols or increasing length.
- Use the Password Generator to create a stronger replacement if needed.
Frequently Asked Questions
What is password entropy?
Entropy measures unpredictability in bits. A password chosen from a 94-character set (all printable ASCII) at 16 characters has ~105 bits of entropy. Higher entropy means exponentially more guesses required to crack, and doubling entropy squares the crack time.
Is it safe to type my real password here?
Yes. The strength analysis runs entirely in JavaScript in your browser. Your password is never sent to any server. However, as a general practice, it's good habit to use a similar but not identical password for testing.
What score should I aim for?
Aim for at least 60 bits of entropy for general accounts and 80+ bits for financial accounts and email. Random passwords from a generator will always outperform memorable passwords of the same length.
Does a high score mean the password can't be guessed?
A high entropy score means the password resists a brute-force attack that tries every possible combination. It does not automatically account for whether the password is a known leaked password, a common phrase, or a keyboard pattern like "qwerty123", real attackers try dictionaries and known-breach lists before brute force, so a memorable phrase can score well here but still be guessed instantly if it already appears in a leaked password list.
Why do two 12-character passwords get different scores?
Entropy depends on the size of the character pool used, not just length. A 12-character password using only lowercase letters draws from a 26-character pool, while one mixing uppercase, digits, and symbols draws from a pool of 94 or more. The wider pool means each character carries more bits of entropy, so the mixed-case password scores meaningfully higher even at the same length.
Common Use Cases
- Checking a new password against a company policy. Before setting a password on a work account, confirm it clears the entropy bar your IT team requires, typically 60+ bits, without having to guess whether it "looks strong enough."
- Auditing an old, reused password. Paste in a password you've used for years to see whether its actual entropy justifies continuing to trust it, or whether it's time to rotate it.
- Comparing two candidate passwords. Test two options back to back to decide which one to actually use for a new account, useful when weighing a memorable phrase against a generator's output.
- Understanding why "clever" substitutions don't help much. Try a password like a common word with numbers swapped for letters to see that length and true randomness matter far more than surface-level complexity tricks.
Entropy Estimation vs Simple Rule-Based Checks
Many login forms use a rule-based check: does the password have a number, an uppercase letter, and a symbol. That approach can be satisfied by a weak password like "Password1!" while rejecting a genuinely strong one like a long lowercase passphrase with no symbols at all. This tool instead estimates entropy, the actual size of the search space an attacker would have to try, based on character pool size and length. Entropy is a better predictor of real-world crack resistance because it captures the mathematical difficulty directly, rather than checking boxes that a predictable password can trivially satisfy. The tradeoff is that entropy estimation alone still can't detect that a password is a known dictionary word or previously leaked, which is why the crack-time estimate here should be read as a best-case upper bound, not a guarantee against smarter, pattern-aware attacks.
Troubleshooting
- My password scores "weak" even though it has a number and a symbol. Length dominates entropy far more than adding one extra character type. A short password with all four character types can still score lower than a longer password using only letters. Increase length first.
- The crack time seems unrealistically long for a password I know is common. The estimate assumes a purely random brute-force search across the full character pool. If your password is a real word, name, or a password that has appeared in a public breach, real attackers will try dictionaries and known-leak lists first, cracking it far faster than the brute-force estimate suggests.
- The strength bar barely moves as I type a long passphrase. If the passphrase uses only lowercase letters and spaces, the character pool stays small, so entropy grows slowly per character. Add a digit or symbol, or add another full word, to increase the pool or length meaningfully.