How it works

Type a password and see its length, character classes, entropy bits, an offline crack-time estimate, and a strength verdict.

The tool scores the password on three dimensions: length, the number of character classes used (uppercase, lowercase, digit, symbol), and the calculated entropy (bits = length × log2(pool size)). A heuristic combines these into a verdict from Very weak to Excellent, with a color-coded strength meter. The offline crack-time estimate assumes 10 billion guesses per second (typical for a fast offline attack on a slow hash like bcrypt). Crack times above 1000 years show as centuries. This is a basic entropy scorer, not a dictionary or breach check. It can't tell you that a common substitution like P-at-ssw0rd123 is already in every cracker's wordlist (it is), only that it's longer than 8 characters and uses four classes. Real-world password security is also about not reusing passwords across sites; this tool only scores a single password's strength against guessing.

How to use it

1. Type a password. Scoring is purely local — nothing is transmitted, logged, or stored.
2. Read the verdict. Length, character classes, and entropy bits combine into a strength rating.
3. Check the crack-time estimate. It assumes 10 billion offline guesses per second; aim for 100+ bits of entropy.
4. Remember the limits. This is an entropy scorer, not a breach or dictionary check — common patterns still rate too high.

Frequently asked questions

Is my password sent anywhere?

No. The scoring is purely local heuristics. Nothing is transmitted, logged, or stored.

Why is 'P@ssw0rd123' rated higher than it should be?

This is an entropy scorer, not a dictionary check. It doesn't know which patterns are in cracker wordlists. For a real-world check, also assume any common substitution pattern is known.

What's a good entropy target?

60 bits is fine for low-value accounts. 100+ bits is excellent. Random 20-character passwords with mixed classes hit ~130 bits.

Does this check if my password has been breached?

No. For breach checks, use a tool that queries Have I Been Pwned with a hashed prefix (the safe k-anonymity protocol).