Check password strength with entropy analysis, time-to-crack calculator, and security score. 100% client-side.
Password complexity is measured by entropy, the number of bits of randomness in a password. Higher entropy means more possible combinations an attacker must try. This tool calculates entropy based on the character pool size (lowercase, uppercase, digits, symbols) and password length using the formula: entropy = length × log₂(pool_size).
The time-to-crack estimate assumes a GPU cluster performing 10 billion guesses per second, which reflects real-world offline attack capabilities using tools like Hashcat or John the Ripper against leaked password hashes.
| Strength | Entropy | Example crack time | Recommendation |
|---|---|---|---|
| Weak | < 28 bits | Seconds to minutes | Never use for any account |
| Fair | 28 – 35 bits | Hours to days | Add length and character types |
| Strong | 36 – 59 bits | Years to millennia | Good for most accounts |
| Very strong | ≥ 60 bits | Millions of years+ | Excellent for critical systems |
Our password crack time calculator estimates how long an attacker would need to guess your password using brute-force at 10 billion attempts per second (a realistic rate for modern GPU clusters running Hashcat). The calculation depends on two factors: the size of the character pool and the password length.
A 6-character password using only lowercase letters (26 characters in the pool) has 26⁶ = 308 million combinations, cracked in under a second. A 16-character password using all character types (95 characters) has 95¹⁶ ≈ 4.4 × 10³¹ combinations, requiring billions of years to crack. This exponential growth is why length matters more than complexity.
| Password length | Lowercase only | Mixed case + digits | All character types |
|---|---|---|---|
| 6 characters | Instant | Instant | 1 minute |
| 8 characters | 21 seconds | 15 hours | 84 days |
| 12 characters | 3 years | 3,800 years | 17M years |
| 16 characters | 1.3M years | 1.5B years | 1.4 × 10²² years |
Estimated at 10 billion guesses/second (GPU cluster with Hashcat). Actual crack time depends on the hash algorithm used by the target service.
A password complexity check evaluates the technical composition of a password: character types used, pool size, and mathematical entropy. A password strength test goes further by also checking against known breached password databases, dictionary words, and common patterns (keyboard walks like "qwerty", date formats, repeated characters).
This tool combines both approaches: it calculates entropy and crack time (complexity check) while also detecting common passwords and patterns (strength test). For a complete security assessment, also check if your password has appeared in known data breaches using our breach checker tool.
No. All analysis runs entirely in your browser using JavaScript. No network requests are made with your password data.
The estimate assumes a brute-force attack at 10 billion guesses per second. Real-world cracking speed depends on the hashing algorithm used by the service storing your password. PBKDF2 or bcrypt slow down attackers significantly compared to MD5 or SHA-1.
Entropy measures the unpredictability of a password in bits. A password with 60 bits of entropy has 2⁶⁰ (about 1.15 quintillion) possible combinations, making brute-force attacks impractical.
Length contributes more to entropy than character variety. A 6-character password using all types has ~39 bits of entropy, while a 16-character lowercase-only password has ~75 bits.