Password Strength Checker
Analyse password strength in real time — entropy, estimated crack time, and actionable tips to improve security.
What is Password Strength Checker?
A password strength checker analyses a password and tells you how secure it is — not just with a weak/medium/strong label, but with a calculated entropy score in bits, an estimated crack time across different attack scenarios, and specific, actionable tips for improvement. Understanding password strength is one of the most important habits in personal and organisational cybersecurity.
Password strength depends on two factors: length and character diversity. Each additional character multiplies the number of possible passwords an attacker must try. Adding uppercase letters, lowercase letters, digits, and symbols expands the character pool from 26 to as many as 95 printable ASCII characters per position. Entropy (measured in bits) quantifies the unpredictability of a password — a higher value means exponentially more guesses required.
This checker uses the zxcvbn algorithm approach, which goes beyond simple character counting. It detects common passwords, keyboard patterns like "qwerty", date patterns, names, dictionary words, and common substitutions like "3" for "e". A password like "P@ssw0rd" scores poorly despite ticking all the character-class boxes because attackers already know these patterns.
The crack time estimates cover three scenarios: offline fast attack (a modern GPU cracking 100 billion hashes per second), online throttled attack (a web login form limited to 100 guesses per hour), and offline slow attack (using bcrypt or Argon2). All analysis happens entirely in your browser — your password is never transmitted to any server.
How to Use Password Strength Checker
- Type your password
Enter any password into the input field. Use the show/hide toggle to reveal or mask the characters.
- Read the entropy score
See the entropy in bits, character pool size, and an overall strength rating from very weak to very strong.
- Check crack time estimates
Review estimated crack times for online and offline attack scenarios to understand real-world risk.
- Follow improvement tips
Read specific suggestions — add length, avoid dictionary words, include more character types — and retype to see the score improve.
Key Benefits
Your password is never sent to any server. All entropy calculations and pattern checks run entirely in your browser.
Goes beyond character-class tick-boxes to calculate real information entropy and identify known attack patterns.
Shows how long your password would withstand a fast GPU attack vs a throttled online login form.
Specific suggestions explain exactly what to change to meaningfully increase your password's strength.
Frequently Asked Questions
Entropy measures how unpredictable a password is, expressed in bits. Each extra bit doubles the number of guesses an attacker needs. A password with 60+ bits of entropy is generally considered strong against offline attacks with modern hardware.
Common substitutions like @ for a and 0 for o are among the first patterns cracking tools try. Despite using four character classes, the underlying word "password" and its predictable variations are in every attacker's dictionary.
Security experts recommend at least 16 characters for sensitive accounts. A random 16-character passphrase or mixed-character string provides enough entropy to be impractical to crack with current hardware. Consider a password manager to generate and store long passwords.
No. The checker runs entirely client-side in your browser using JavaScript. Nothing you type is sent to a server, stored in a cookie, or logged anywhere. You can verify this by disconnecting from the internet before testing.