Password Strength Checker

Entropy, measured in bits, describes how unpredictable a password is. A password with N bits of entropy means an attacker would need to try up to 2ᴺ guesses to guarantee finding it — and on average would find it halfway through, after 2^(N−1) guesses. The higher the entropy, the larger the search space, and the longer a brute-force or dictionary attack takes. A 40-bit password might fall in seconds on a GPU; an 80-bit password would take millions of years under the same conditions.

Charset entropy is a theoretical upper bound: it assumes every character was drawn at random from the full pool of character types you used (lowercase, uppercase, digits, symbols). It tells you how strong the password could be given its length and variety. Effective entropy is the realistic lower bound after subtracting penalties for patterns — sequential runs, keyboard walks, common words, l33t-speak substitutions, and date strings. Attackers don't try every possible combination in order; they try the most likely guesses first. Effective entropy models that threat more honestly.

The tool estimates the expected number of guesses needed to find your password as 2^(effectiveEntropy − 1) — on average, the correct password is found halfway through an exhaustive search. Dividing that by each scenario's guesses-per-second gives the expected crack time. The five scenarios range from a rate-limited login form (~0.028 guesses/second) to a nation-state GPU cluster (100 trillion hashes/second), covering the realistic threat spectrum for most passwords.

No. All analysis happens entirely inside your browser using JavaScript. Your password never leaves your device and is never transmitted over the network. You can even disconnect from the internet and the tool will keep working.

The biggest driver is length — every additional character multiplies the search space exponentially. After length, randomness matters most: using all four character classes (lowercase, uppercase, digits, symbols) and avoiding predictable patterns. A 20-character random password using only lowercase letters is still stronger than a 10-character password using all four classes. The ideal password is long, randomly generated, and unique to each account — which is exactly what password managers are designed for.

Common tricks like capitalising the first letter, appending 123 or !, substituting @ for a, or adding a birth year are all included in every serious cracking dictionary. Attackers apply these transformations automatically. A password like P@ssw0rd2024! looks complex but resolves to a well-known base word after de-substitution — the tool's l33t-speak and date detectors catch exactly this. Genuine randomness is the only reliable defence.

A rough guide based on current hardware:

• Below 40 bits — crackable in seconds to hours even against a slow hash
• 40–60 bits — adequate for rate-limited online accounts, but weak offline
• 60–80 bits — strong against most offline attacks with bcrypt/Argon2
• 80–100 bits — very strong; would take years against fast GPU hashing
• 100+ bits — effectively uncrackable by any currently feasible means For accounts that store sensitive data, aim for at least 80 bits of effective entropy — easily achievable with a 16+ character random password or a four-word passphrase.

A keyboard walk is a sequence of characters that are physically adjacent on a standard QWERTY keyboard — qwerty, asdf, zxcv, 1qaz, and similar runs. They feel random to the eye but are systematically covered by every major password cracking tool. The tool detects runs of four or more adjacent keys in any horizontal row, in either direction.

A fast hash (MD5, SHA-1, SHA-256) is designed for speed — useful for checksums, but catastrophic for password storage because an attacker can test billions of candidates per second on a GPU. A slow hash (bcrypt, scrypt, Argon2) is deliberately computationally expensive, limiting attackers to thousands of guesses per second even on powerful hardware. If you don't know which type your service uses, assume the worst. This is why having a high effective entropy matters even against slow hashes.

A passphrase — four or more unrelated random words (e.g. correct horse battery staple) — can achieve high entropy while remaining memorable. A four-word passphrase drawn from a list of 7,776 words (EFF diceware) has roughly 51 bits of charset entropy; five words gives ~64 bits. The trade-off compared with a fully random character password of similar length is that passphrases have a smaller effective pool (words, not individual characters), so length becomes even more important. Both approaches are valid — use whichever you'll actually store and use correctly.

If you reuse a password and one service is breached, attackers immediately try that credential on every other popular site — a technique called credential stuffing. Billions of username/password pairs from past breaches are freely available online. A strong, unique password means a breach of one site doesn't cascade into a breach of your bank, email, or cloud storage. A password manager makes this practical by generating and storing a distinct password per account.

The generator uses crypto.getRandomValues — the browser's cryptographically secure pseudorandom number generator (CSPRNG), the same source used for TLS key generation. It first guarantees at least one character from each enabled class, then fills the remainder from the combined pool, and finally applies a Fisher-Yates shuffle so the mandatory characters are distributed randomly rather than clustered at predictable positions. Unlike Math.random, a CSPRNG is not predictable from its seed or from observing its output.