🔒
🔒 Your password is analyzed entirely in your browser. It is never sent to any server, stored, or transmitted anywhere.
// analyze password strength, entropy, and crack time
Check password strength instantly with entropy calculation, pattern detection, crack-time estimate, and actionable suggestions. Browser-based, your password never leaves your device.
Enter any password into the field. Analysis starts instantly — no button press needed. The password field is masked by default; click the eye icon to reveal it.
The score, entropy in bits, estimated crack time, and character composition are computed immediately. Detected patterns (like keyboard walks or repeated characters) are shown as warnings.
Actionable tips show exactly what would improve your password's strength. Check all the requirements boxes for a strong password.
Password entropy (measured in bits) quantifies the randomness of a password. A 1-bit increase doubles the number of possible passwords. 40 bits = adequate, 60 bits = strong, 80+ bits = very strong. The formula is L × log₂(P) where L is length and P is the character pool size.
Yes. All analysis happens entirely in your browser using JavaScript — your password is never sent to any server, never stored, and never transmitted anywhere. You can even use this tool offline once the page has loaded. The analysis runs locally on your device.
The score combines multiple factors: base score from entropy (length × character pool), bonuses for using diverse character types (uppercase, digits, symbols), and penalties for detected patterns (dictionary words, keyboard sequences, repeating characters, common substitutions). A score of 0–39 is weak, 40–59 is fair, 60–79 is good, 80–100 is strong.
The crack time is calculated assuming an offline attack at 10 billion guesses per second (a typical high-end GPU hash cracking rate for common algorithms like bcrypt). The estimate reflects brute-force cracking of the raw password character space. For passwords with detected patterns, the effective crack time is lower because attackers use optimized wordlists and rule-based attacks.
The analyzer detects: common weak passwords (from a built-in top-1000 list), keyboard walks (qwerty, 12345, asdf), repeated character sequences (aaa, 111), common leet substitutions (p@ssw0rd), predictable year/date patterns, single-character padding (password!!), and reverse-string patterns.
Length is the single most important factor — each additional character exponentially increases the search space. A 20-character password of lowercase letters (26^20 = 19 septillion possibilities) is harder to crack than a 10-character password using all character types (94^10 = 53 quadrillion possibilities). Combine length with character diversity and avoid patterns for maximum strength.
Yes — passphrases (four or more random words like correct-horse-battery-staple) are both strong and memorable. A 4-word passphrase from a 2048-word vocabulary has 44 bits of entropy. A 5-word passphrase has 55 bits. This tool scores passphrases accurately — try entering a few random words separated by hyphens or spaces.
At 10 billion guesses/second, a 60-bit random password takes about 36 years to crack by brute force. At 80 bits, it would take longer than the age of the universe. For most use cases, 60+ bits with no detected patterns is sufficient. For high-value accounts (banking, email), aim for 80+ bits. The requirements checklist shows exactly what you need to reach each threshold.
Most people intuitively know that password123 is weak and X#9kL!mQr7@s is strong — but the difference between "good" and "very strong" is less obvious. This tool quantifies password strength with a mathematical model, giving you exact entropy values and estimated crack times rather than vague descriptors.
Password entropy is measured in bits and calculated as L × log₂(P), where L is the length and P is the size of the character pool. A password using only lowercase letters (pool = 26) at 8 characters has 37.6 bits of entropy. Adding uppercase letters (pool = 52) increases it to 45.6 bits. Adding digits and symbols (pool = 94) reaches 52.4 bits. Adding just two more characters at 94-character pool (10 characters total) reaches 65.5 bits — more than double the security of the 8-character lowercase version.
Modern password cracking doesn't work character-by-character. Attackers use sophisticated techniques: wordlists of millions of common passwords, rule-based transformations (adding numbers to the end, substituting letters with numbers), keyboard pattern detectors, and hybrid attacks combining dictionary words with mutations. A password like P@ssw0rd! looks complex but is trivially cracked because the pattern is in every wordlist. True security comes from genuine randomness — characters or words chosen without any pattern.