Password Strength Checker

The tool assumes an attacker using modern GPU hardware at 10 billion guesses per second — a realistic estimate for a motivated attacker with consumer hardware. The crack time is based on the total search space (all possible passwords of that length and character set) divided by that rate.

Entropy measures password randomness in bits. Each additional bit doubles the number of possible combinations. At 40 bits (~1 trillion combinations), a GPU cracks it in about 100 seconds. At 60 bits, years. At 80+ bits, centuries. The tool calculates entropy based on the actual character pool you use, showing you exactly how strong your password is mathematically.

12 characters with all character types (upper, lower, digits, symbols) gives roughly 72+ bits of entropy — strong in 2026. But 16+ characters is where you get real safety margin. Crucially: length matters more than complexity. A 20-character lowercase passphrase beats an 8-character "complex" password because the search space is vastly larger.

Attackers know common substitution patterns: "@" for "a", "0" for "o", "3" for "e", capitalizing the first letter, adding numbers and symbols at the end. Their tools try these patterns first. "P@ssw0rd123!" effectively has a very small real search space because it follows predictable rules. True strength requires genuine randomness, not patterned complexity.

Use a password manager (Bitwarden, 1Password, KeePass) and let it generate 16+ character random passwords. If you need a memorable password, use a passphrase: 4-5 random unrelated words like "correct-horse-battery-staple". Check haveibeenpwned.com to see if your passwords appeared in data breaches. Never reuse passwords across sites.

Keyboard sequences (qwerty, 12345, asdf), repeated characters (aaa, 111), common password patterns (password, p@ssw0rd), dictionary words, and simple number sequences appended to words. These patterns all dramatically reduce effective entropy even if the password appears complex.

Never. The entire analysis runs in JavaScript locally on your device. No server calls, no analytics on input, no logging of any kind. You can disconnect from the internet and the tool works identically.