Check a password's entropy, character pool and crack time at four stated guessing rates — and see whether it appears on a list of common passwords. Runs entirely in your browser — your numbers never leave this device.
| Attack scenario | Guesses per second | Average time |
|---|---|---|
| Online, unthrottled worst case | 100 | 85.6 trillion years |
| Offline, slow hash | 1,000,000 | 8.56 billion years |
| Offline, fast hash / GPU | 10,000,000,000 | 856 thousand years |
| Large cracking rig | 1,000,000,000,000 | 8.56 thousand years |
Your password is analysed locally in your browser — it is never stored, sent or logged.
The entropy figure assumes every character was chosen at random from the pool. Real passwords picked by humans follow patterns and are weaker than the number suggests — treat it as a best case, not a guarantee.
| Scenario | Guesses per second | What it represents |
|---|---|---|
| Online, unthrottled worst case | 100 | Guessing against a live login page with no rate limiting — a badly run site |
| Offline, slow hash | 1,000,000 | A leaked database hashed with a slow, modern password hash |
| Offline, fast hash / GPU | 10,000,000,000 | A leaked database hashed with a fast hash, attacked with graphics cards |
| Large cracking rig | 1,000,000,000,000 | A well-funded attacker with a purpose-built cracking cluster |
Type a password and the checker works out which character classes it actually uses — lowercase, uppercase, digits, symbols, and any non-ASCII characters — then adds up the pool those classes give it. Entropy is length times log2 of that pool: it counts, in bits, the size of the space an attacker would have to search if every character had been chosen at random from the pool. The crack-time table then divides half that space (attackers find the answer after searching half of it, on average) by four stated guessing rates, from 100 guesses a second for an online attack to a trillion a second for a large cracking rig, so you can see exactly which assumption produces which number.
Two warnings are printed because the raw number flatters real passwords. First, the entropy formula assumes random selection — that every character was drawn independently and unpredictably. Passwords picked by humans are weaker, often far weaker: they contain words, names, dates, keyboard walks and runs like abcd or 4321, all of which guessing programs try early, in bulk. This checker flags runs of four or more sequential characters and all-same-character passwords, and it checks your entry against a built-in list of common passwords — a match there is reported as effectively 0 bits, because leaked-password lists are the first thing an attacker tries. Second, the crack times are labelled estimates at stated rates against an offline copy of a password database; a well-run website slows online guessing far below even the slowest rate shown, and a fast hash on a big rig is the scenario worth planning for.
Your password is analysed locally in your browser — it is never stored, sent or logged. It lives only in this page's memory while you type, it is never placed in the page address, and closing the tab destroys it. That is the only safe way to offer a strength checker at all: a tool that uploaded passwords to analyse them would be creating the very database attackers dream about. Still, good practice is to check a close variant of a real password rather than the password itself, and to generate the real one with a proper generator — the Password Generator linked below draws from the browser's cryptographic random source.
Into this one, the mechanics are on your side: your password is analysed locally in your browser — it is never stored, sent or logged, and it never appears in the page address. Even so, the cautious habit is worth keeping for checkers generally: test a variant with a few characters changed, which gives an almost identical entropy reading, rather than the exact password — and never type a real password into any site that asks for it alongside your email address or username.
Because length is only half the formula. A 20-character password built from lowercase letters alone draws on a pool of 26; the same length with uppercase, digits and symbols draws on 95, and each character carries 6.57 bits instead of 4.70. The other usual cause is a pattern flag: a sequence run like abcd or 4321, or a repeated character, tells you part of the password is predictable no matter what the raw entropy says.
Its exact text — compared case-insensitively — appears on the built-in list of passwords that turn up again and again in leaked databases: password, 123456, qwerty, letmein and their relatives. Attackers run those lists against accounts before anything clever, so a listed password's effective entropy is reported as 0 bits even when its length-and-pool arithmetic looks respectable. Adding a digit to a common password does not rescue it — password1 is on the list too.
No, and the page does not claim they are. Each figure is labelled with the guessing rate that produced it, and it assumes the attacker must search half the space on average against an offline copy of the password database. Real outcomes depend on how the site hashed its passwords, how much hardware the attacker rents, and whether your password follows a pattern the search tries early — which is why the entropy figure carries its own warning that it assumes random selection.
For a generated password stored in a password manager, 75 bits or more is a sound target — sixteen lowercase characters reach 75.2 bits, and twelve characters from the full pool reach 78.8. For the one password you must memorise, such as the manager's own master password, aim higher and prefer a long passphrase of unrelated words over a short, dense string you will mistype and simplify over time.
No — it widens the pool only if it is actually present, and one predictable symbol does less than one more random character. Swapping a for @ or ending with ! is a pattern attackers model explicitly. The levers that genuinely work are length and real randomness: generate the password instead of inventing it, and let this checker verify the result rather than inspire it.
More in Everyday Tools & Generators · Browse all tools