Password Strength Checker
'Strong password' is useless advice without a number. This checker gives two: entropy in bits (length × log₂ of the character pool you actually used) and what those bits mean in practice - how long the password survives a throttled online attack, a single gaming GPU, or a well-funded datacenter. Dictionary words, keyboard patterns, repeats and date-shaped tails are detected and deducted, because crackers try them first and brute-force math flatters them.
The privacy bar is absolute: nothing you type is stored, remembered or sent anywhere - there is deliberately no URL state and no input memory on this tool, because a password must never persist. The note under the result explains why length beats symbol soup and why reuse is the real breach multiplier.
How to use
- Type (not paste from your manager, for this test) a candidate password.
- Read the entropy bits, the verdict and the three attack-scenario times.
- Adjust: doubling length beats adding a symbol every time - test and see.
Frequently asked questions
How is password strength measured?
Entropy: each character adds log₂(pool size) bits - lowercase-only adds 4.7 bits per character, mixed case+digits+symbols adds about 6.5. A 12-character random lowercase password (~56 bits) beats 'P@ss1!' (~33 bits) comfortably, which is why the verdict follows the math and not the aesthetics.
What do the crack-time estimates assume?
Three honest rates: ~100 guesses/second against a rate-limited login form, 10^10/s for an offline GPU cracking a stolen hash, and 10^14/s for warehouse-scale hardware. Real cracking is dictionary-guided and uneven, which is exactly why the pattern deductions exist.
Why does 'Password1!' score badly when it's complex?
Complexity rules check character classes, crackers check dictionaries first - and 'password' with a suffix is the most-guessed pattern in every breach dump. The checker normalizes leetspeak (0→o, 3→e, @→a) before its word list, so cosmetic substitutions do not buy back security.
Does this tool store or transmit what I type?
No - deliberately. The entropy math runs in your browser; there is no input memory, no share-with-data link and no network call on this page, and the share button sends only your score. The one habit no checker can fix is reuse, so rotate passwords between sites or use a manager.