Password Strength Checker

Entropy can describe the size of a theoretical search space when a password is generated uniformly at random. This checker estimates indicators from the characters and patterns it recognizes; it cannot know how a password was chosen or predict how an attacker would guess it. Treat the displayed bits and crack times as rough illustrations, not measured security.

Charset entropy is a theoretical upper bound: it assumes every character was drawn uniformly at random from the full pool of character types present. That assumption may not hold for a human-chosen password. Effective entropy is this tool's heuristic score after applying fixed penalties for patterns it recognizes. It is not a measured or guaranteed lower bound, and the checker may miss patterns.

The tool divides a theoretical guess count derived from its heuristic score by fixed example guessing rates. Real attack speeds and account defenses differ, and dictionary attacks do not guess uniformly. These times are illustrations only, not predictions of how long a password will withstand an attack.

The analysis is performed in your browser. Even so, avoid entering a password you currently use for an important account into a website. Use a newly generated example instead.

Use a long, unique password generated and stored by a trusted password manager. You do not need to add character types just to satisfy this checker's checklist; follow the account provider's requirements and avoid predictable or reused passwords.

Capitalization, substitutions, and appended numbers can be predictable, especially when built around a common word. The checker catches some examples, but its list is limited and a high score does not prove a password is hard to guess.

There is no universal bit threshold from this checker that guarantees safety. Its entropy-like values and attack scenarios use simplified assumptions. A password manager's randomly generated, unique password is a more dependable choice than targeting a displayed score.

A keyboard walk is a sequence of adjacent keys, such as qwerty or asdf. The checker detects some horizontal QWERTY-row sequences, but it does not cover every keyboard layout or pattern.

A fast hash (such as MD5 or SHA-256) is designed for speed and is unsuitable for password storage. Password-hashing algorithms such as bcrypt, scrypt, and Argon2 are designed to make each guess more expensive. Actual guessing rates vary with the algorithm's settings and attacker hardware; this checker does not measure them.

A passphrase can be memorable, but its strength depends on how the words were selected and on the word list. This checker does not analyze passphrases with a word-list model, so its score may be misleading for them. Use a trusted password manager or an established passphrase generator.

If you reuse a password and one service is breached, attackers immediately try that credential on every other popular site — a technique called credential stuffing. Billions of username/password pairs from past breaches are freely available online. A strong, unique password means a breach of one site doesn't cascade into a breach of your bank, email, or cloud storage. A password manager makes this practical by generating and storing a distinct password per account.

The built-in generator uses the browser's crypto.getRandomValues when available. It guarantees at least one character from each selected class and shuffles the result. For sensitive accounts, prefer a trusted password manager, which can generate and securely store unique credentials.