Password Strength Checker
Estimate a password’s entropy and crack time offline — the only way to check one without disclosing it.
Processed on your device — no upload
This never leaves your browser. That is not a nicety — a strength checker that uploads what you type has been given your password.
Type a password. Its entropy, the time an offline attack would need, and the patterns cracking tools try first all appear here — without the password leaving this page.
How to use it
- Type or paste the password.
- Read the entropy and the estimated crack time.
- Act on the warnings, if there are any.
How it works
Entropy is calculated from the size of the character pool and the length: a password using lowercase, uppercase and digits draws from 62 characters, so each character contributes about 5.95 bits. Twelve of them is roughly 71 bits.
That figure assumes the password is genuinely random, and most are not. Password123! scores well on the arithmetic and falls in under a second in practice, because it is in every wordlist an attacker owns. The checker looks for common passwords, keyboard runs, alphabet sequences and repeated characters, and reports them separately rather than pretending the number covers them.
Crack time assumes 100 billion guesses per second — an attacker who has stolen a password database and is working offline with modern hardware. An online login form is thousands of times slower and usually rate-limited, which is why a mediocre password survives there and does not survive a breach. The offline number is the one worth planning against.
None of this leaves your browser, which is the entire reason to use a local tool for this: a strength checker that uploads what you type has been handed your password, and you have no way to know what it did with it.
A worked example
Try three passwords in order and watch what the numbers do.
Summer2026! — eleven characters, upper, lower, digits and a symbol. The arithmetic gives about 66 bits, which sounds respectable. The warnings say otherwise: under twelve characters, and it follows the word-year-symbol pattern that cracking tools generate first. Real-world resistance: minutes.
correcthorsebatterystaple — twenty-five lowercase characters, about 117 bits by the formula. No warnings. Genuinely strong against brute force — though a wordlist built from the famous comic that popularised it would find this specific string instantly, which is the general lesson: anything published is no longer random.
Harbor-Lantern-Cobalt-Meadow from the generator — comparable entropy, and it was drawn randomly rather than chosen, which is what the number actually assumes.
The pattern across all three: length beats complexity. Adding a symbol to an eight-character password gains a few bits. Adding four more characters gains twenty-four. Every requirement to include a symbol has produced a generation of Password1!, which is why security guidance has moved towards length and away from composition rules.
Questions
What makes a password secure in practice?
Length and not appearing in any leak. Sixteen characters beats eight with symbols by a factor of millions, and a password that has appeared in a breach falls instantly whatever its length.
Is it safe to test a real password here?
Yes, and that is the point. The check runs in this page and nothing is transmitted, so you can audit a password you actually use without disclosing it.
Is my password sent anywhere?
No, and that is the point of the tool. It is analysed in your browser. A checker that uploads what you type has been given your password.
What crack speed does it assume?
100 billion guesses per second — a stolen password database being attacked offline with modern hardware. Online login forms are thousands of times slower.
Why does a password with symbols score badly?
Because complexity rules produce predictable patterns. Password1! draws from a large alphabet and is in every wordlist. The warnings cover what the arithmetic cannot see.
What is a good entropy figure?
Under 40 bits is weak. Around 60 is reasonable for an account behind rate limiting. Above 80 is beyond any realistic offline attack.
Does the estimate know if my password was in a breach?
No. Checking that requires querying a breach database, which means disclosing something about the password. This tool stays entirely local by design.
Length or complexity?
Length, decisively. Four extra characters add far more resistance than adding a symbol to a short password, and they are easier to remember.
Should I trust these numbers exactly?
Treat them as an order of magnitude. Real attacks use wordlists, patterns and rules rather than pure brute force, so a password with warnings is weaker than its number suggests.
Is it safe to type my real password here?
It never leaves your device — verify it in the Network tab or by going offline first. As a general habit, be cautious about typing real passwords into any website, including this one.