Password Strength Checker — Entropy & Crack Time, Private
Strength —
Length 0
Entropy (bits) 0
Crack time —
Type a password to see how strong it really is. This checker measures its entropy in bits, estimates how long an offline attacker would need to crack it, and points out weak spots like common passwords, keyboard runs, and repeated characters. Nothing you type is sent anywhere — the whole check runs in your browser.
How it works
- 1 Type or paste a password Enter the password you want to test. Use the Show button if you want to read it back while you type.
- 2 Read the strength meter The colored bar and label update on every keystroke, from Very weak to Very strong, based on the password's entropy.
- 3 Fix the weak spots The tips below the meter tell you exactly what to change — add length, mix character types, or drop a predictable pattern.
Your data stays private
All processing happens entirely in your browser. No files, text, or data are ever sent to our servers. You can disconnect from the internet and this tool will still work.
Frequently asked questions
- Is my password sent to a server?
- No. The check runs entirely in JavaScript inside your browser. Your password is never transmitted, logged, or stored — you can disconnect from the internet and the checker still works.
- What is password entropy?
- Entropy measures unpredictability in bits. It is calculated from the length and the size of the character pool: a longer password drawn from a bigger pool of letters, digits, and symbols has higher entropy and takes exponentially longer to guess.
- How is the crack time estimated?
- It assumes an offline attacker who has your password's hash and can try 10 billion guesses per second on modern GPUs. The estimate is the average time to exhaust half the keyspace at that rate. Real times vary with the hashing algorithm, but this is a useful worst-case yardstick.
- Why is a long simple password stronger than a short complex one?
- Each extra character multiplies the number of possibilities, so length adds entropy faster than swapping a letter for a symbol. A 16-character passphrase of plain words usually beats an 8-character mix of symbols and digits.
- Does the checker recognize common passwords?
- Yes. Passwords that appear on public breach lists — like 'password123' or 'qwerty' — are flagged and scored as though an attacker would guess them almost instantly, regardless of their raw entropy.
- Should I use this on my real passwords?
- It is safe to, because nothing leaves your browser. That said, the best habit is a password manager that generates and stores long random passwords for you, so you never have to type or remember them.