Free Password Strength Checker – See Entropy and Crack Time

What Your Password Score Actually Measures

A password strength checker answers one narrow question: how many guesses would an attacker need before stumbling onto your password? That number, expressed in bits of entropy, is the only honest measure of strength. A green bar on a signup form usually just counts whether you included an uppercase letter and a digit, which is why "Summer2024!" sails through most forms while a cracking rig breaks it in seconds. This checker scores the two things that actually matter — how large the search space is, and how much of that space an attacker can skip because your password follows a predictable shape. Everything happens inside your browser tab, so the password you type never travels over the network, never reaches a log file, and never gets stored. The base calculation is straightforward. Entropy in bits equals length multiplied by the base-2 logarithm of the character pool size, written as E = L × log₂(N). L is the number of characters you typed and N is the size of the pool the attacker must search: 26 for lowercase, another 26 for uppercase, 10 for digits, and roughly 33 for common symbols, giving a maximum pool of 95. An attacker needs about 2^E ÷ 2 guesses on average, and dividing that by a guess rate converts it to time. Two rates are shown because they differ by six orders of magnitude. A site storing passwords properly with bcrypt or Argon2 slows an offline attack to roughly 10,000 guesses per second. A site using a fast unsalted hash like SHA-1 lets a single modern GPU rig run about 10 billion guesses per second. Same password, wildly different outcome, and you have no control over which one your bank chose. Raw entropy alone flatters bad passwords, so recognised patterns subtract bits. Take the classic example "Tr0ub4dor&3". Eleven characters drawn from a 95-symbol pool gives 72 bits on paper, which sounds excellent. But undoing the digit substitutions reveals a single dictionary word, and cracking software has tried l33t swaps since the 1990s. After the dictionary penalty the effective figure lands near 46 bits, which is roughly an hour on a fast unsalted hash. Now compare the passphrase "correct horse battery staple": 28 characters, but strength here comes from choosing four words, not from length, so it is scored as 4 × log₂(20000) ≈ 57 bits. Still stronger than the first password despite looking far simpler to type, which is the whole point of the comparison. The penalties cover the patterns that appear again and again in leaked password dumps. An exact match against a common-password blocklist wipes out most of the score. A whole dictionary word inside the password costs bits, and a word with one letter dropped costs the same, because misspelling "troubadour" as "troubador" fools nobody. Keyboard runs like qwer or asdf, sequential runs like abc and 789, a character repeated three times, a four-digit year, and the Capital-word-digits-symbol shape that corporate password rules practically force people into all reduce the effective figure. When three or more words separated by spaces or hyphens are detected, the tool switches to passphrase scoring instead of stacking word penalties, since a genuine multi-word phrase is a different beast from one word plus decoration. A few practical notes on reading the result. Anything under 28 bits should be treated as already broken, 40 to 60 bits is acceptable only where a slow hash and rate limiting protect you, and above 80 bits is comfortable for anything you care about. Length beats complexity almost every time: adding four random lowercase letters buys about 19 bits, while sprinkling one symbol into an eight-character password buys under three. The pitfall worth naming is that no strength score protects a reused password. If the same string guards your email and a forum that leaks next year, attackers will replay it against every major service within hours, and 100 bits of entropy will not save you. Use a unique password per account, keep them in a password manager, and turn on two-factor authentication wherever it is offered. Since the analysis runs locally, you can safely test a password you are already using, though changing one you suspect is weak is still the better move.

Password Strength Checker Formula & Method

🔥 Trending Tools