Check password strength with entropy analysis, time-to-crack calculator, and security score. 100% client-side.
Password complexity is measured by entropy, the number of bits of randomness in a password. Higher entropy means more possible combinations an attacker must try. This tool calculates entropy based on the character pool size (lowercase, uppercase, digits, symbols) and password length using the formula: entropy = length × log₂(pool_size).
The time-to-crack estimate assumes a GPU cluster performing 10 billion guesses per second, which reflects real-world offline attack capabilities using tools like Hashcat or John the Ripper against leaked password hashes.
| Strength | Entropy | Example crack time | Recommendation |
|---|---|---|---|
| Weak | < 28 bits | Seconds to minutes | Never use for any account |
| Fair | 28 – 35 bits | Hours to days | Add length and character types |
| Strong | 36 – 59 bits | Years to millennia | Good for most accounts |
| Very strong | ≥ 60 bits | Millions of years+ | Excellent for critical systems |
No. All analysis runs entirely in your browser using JavaScript. No network requests are made with your password data.
The estimate assumes a brute-force attack at 10 billion guesses per second. Real-world cracking speed depends on the hashing algorithm used by the service storing your password. PBKDF2 or bcrypt slow down attackers significantly compared to MD5 or SHA-1.
Entropy measures the unpredictability of a password in bits. A password with 60 bits of entropy has 2⁶⁰ (about 1.15 quintillion) possible combinations, making brute-force attacks impractical.
Length contributes more to entropy than character variety. A 6-character password using all types has ~39 bits of entropy, while a 16-character lowercase-only password has ~75 bits.