Password Strength Checker
See how strong your password really is — live entropy in bits, a strength rating and an estimated time to crack. Everything is computed as you type, entirely in your browser.
Analyzed locally · nothing leaves your device- Start typing to see suggestions for a stronger password.
How it works
This checker measures entropy — the number of bits of randomness in your password — using the formula bits = length × log2(poolSize). The pool size is the count of distinct characters an attacker would have to consider, inferred from the classes you actually used: lowercase letters add 26, uppercase 26, digits 10 and symbols roughly 32. A 12-character password drawn from all four classes has a pool of 94, giving about 79 bits of entropy.
The estimated crack time assumes an offline attacker capable of 10 billion guesses per second, so the time to exhaust the space is 2^bits / 1e10 seconds, formatted up through minutes, hours, days, years and millennia. This is a worst-case model: entropy math treats every character as random, so predictable words, keyboard walks and repeated characters are weaker than their length implies. The feedback list flags the most common of these issues. All of this runs in JavaScript on your device — there is no server request, so your password is never exposed.
Frequently asked questions
Is my password sent anywhere?
How is the strength calculated?
length × log2(poolSize), where the pool size is inferred from which character classes appear: lowercase (26), uppercase (26), digits (10) and symbols (~32). More bits means exponentially more possible passwords, so the strength label and crack-time estimate both derive from that figure.How accurate is the crack-time estimate?
10 billion guesses per second against a fast, unsalted hash — a deliberately pessimistic scenario. Real-world time depends on the hashing algorithm and hardware, but this gives a useful worst-case sense of scale.Why does a long simple password beat a short complex one?
correct-horse-battery-staple is far harder to brute-force than P@ss1!. Note that entropy math assumes randomness — dictionary words and common patterns are weaker than their raw length suggests.