Test any password instantly. See entropy, estimated crack time, and what to fix — everything runs in your browser, nothing is ever sent anywhere.
Your password never leaves your device — analysis is 100% client-side.
Understanding Password Strength
Entropy measures how unpredictable your password is — expressed in bits. Each bit doubles the number of possible combinations an attacker must try. A password with 60 bits of entropy has over a quintillion possible values. At 80+ bits, brute-force attacks become computationally infeasible with modern hardware. Our checker calculates entropy based on your actual character set size multiplied by password length.
Crack time is estimated assuming an attacker using a modern GPU rig capable of billions of hash checks per second — a realistic threat model for leaked credential databases. The estimate assumes random guessing (brute force). Dictionary attacks against common words or patterns are faster, which is why using real words, names, or keyboard walks dramatically lowers your effective strength even at longer lengths.
Sequential runs like abc, 123, or qwerty and repeated characters like aaa are among the first patterns attackers test. Many hacking dictionaries include thousands of common patterns and their variants. Even a technically long password like password123! scores poorly because it follows a predictable structure that appears in breach databases.
Length wins in the long run. A 20-character lowercase-only password has more entropy than a 10-character password using every character type. The ideal approach combines both: 16+ characters drawn from uppercase, lowercase, numbers, and symbols gives you the strongest possible result. For passwords you need to type manually, a 4–5 word passphrase achieves high entropy while remaining memorable.
Frequently Asked Questions