Password Strength Analyser

How to use this password strength analyser

1. Type a password into the box — nothing is sent anywhere, it all happens on your device.
2. Watch the bar and label update in real time as you type, from "Very weak" to "Very strong".
3. Check the entropy and estimated crack time to understand exactly why a password is weak or strong.

How is this calculated?

Entropy is estimated as log2(character_set_size ^ length), a standard measure of how many guesses a brute-force attacker would need. Crack time assumes 10 billion guesses per second, a realistic rate for offline attacks against weakly-hashed passwords.

Is my password sent anywhere?

No — everything is calculated locally in your browser and never transmitted or stored.

Why the entropy formula can overestimate real-world strength

The entropy calculation this tool uses — log2(character set size ^ length) — measures the size of the search space assuming every character was chosen with true, uniform randomness. Human-chosen passwords rarely work that way: a password like "P@ssw0rd123" scores well on this formula because it draws from a large character set (uppercase, lowercase, digits, symbols), but it's actually one of the most commonly guessed passwords in the world, since it follows an extremely predictable pattern (a common word, a capital letter at the start, common symbol substitutions, a number sequence at the end). Real attackers don't brute-force randomly through the full character set — they try dictionary words, known breached passwords, and common patterns first, which is why a mathematically high entropy score doesn't guarantee real-world resistance to how passwords are actually attacked in practice.

Why length beats complexity — the math behind it

Adding one more character to a password multiplies the search space by the character set size, while adding one more allowed character type barely changes it. A 16-character password using only lowercase letters (26 possibilities per character) has a search space of 26^16, which is larger than an 8-character password using the full range of uppercase, lowercase, digits, and symbols (roughly 95^8) — despite the second password looking more "complex" at a glance. This is the mathematical reason security guidance has shifted heavily toward "make it long" over "make it complicated": each additional character has a bigger multiplicative effect than each additional character-set option, especially once a password already includes a reasonable mix.

Why crack time estimates can be off by six orders of magnitude

The crack time shown here assumes a fixed guess rate (10 billion guesses per second), which is realistic for an attacker who has stolen a database where passwords were hashed with a fast, unsuitable algorithm like plain SHA-256 — but is wildly unrealistic if the password was instead hashed with a purpose-built, deliberately slow algorithm like bcrypt or Argon2. A password hashing scheme with a well-tuned cost factor can reduce achievable guesses per second from billions down to just a few hundred or thousand, which changes an estimated crack time from hours to centuries for the exact same password. This means the real-world security of any specific password depends heavily on something this tool can't know: how (and how well) whatever system stores it actually hashes it.

Passphrases as a practical strategy, not just a theory

A common, practical approach that scores well by both the entropy math and real-world resistance to guessing is a passphrase built from several random, unrelated words — something like "correct horse battery staple" (from the well-known XKCD illustration of this exact idea) rather than a single word with substitutions. Four to six words chosen truly at random from a reasonably large word list (a technique often called Diceware) produces genuinely high entropy while staying far easier to remember and type than an equivalent-strength string of random characters and symbols, since human memory handles a sequence of real words far better than arbitrary character noise. The key requirement is genuine randomness in the word selection — words chosen because they relate to something personally memorable (a pet's name, a favorite phrase) reintroduce the same predictability problem substitution patterns have.

Limitations of this tool

This analyzer computes a mathematical entropy estimate and a theoretical crack time based on character set size and length — it doesn't check the password against lists of known breached passwords, doesn't detect common patterns like keyboard walks (qwerty, 12345) or predictable substitutions (@ for a, 0 for o), and doesn't know anything about how the system you'll actually use this password with stores or hashes it. A password that scores well here can still be a bad choice if it appears in breach databases or follows an obviously guessable pattern, and a password that scores lower here can still be adequately protected if the destination system uses strong, slow password hashing — treat this as one useful signal about raw randomness, not a complete real-world security verdict.